DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans

Authors: yuan  gan
jiaxu  miao
yi  yang
Venue: NeurIPS_cc_2024_Conference
Published: 2024-04-23 08:04:26

Abstract: Federated Learning (FL) is commonly used to collaboratively train models with privacy preservation. In this paper, we found out that the popular diffusion models have introduced a new vulnerability to FL, which brings serious privacy threats. Despite stringent data management measures, attackers can steal massive private data from local clients through multiple Trojans, which control generative behaviors with multiple triggers. We refer to the new task as ${\bf\textit{DataStealing}}$ and demonstrate that the attacker can achieve the purpose based on our proposed Combinatorial Triggers (ComboTs) in a vanilla FL system. However, advanced distance-based FL defenses are still effective in filtering the malicious update according to the distances between each local update. Hence, we propose an Adaptive Scale Critical Parameters (AdaSCP) attack to circumvent the defenses and seamlessly incorporate malicious updates into the global model. Specifically, AdaSCP evaluates the importance of parameters with the gradients in dominant timesteps of the diffusion model. Subsequently, it adaptively seeks the optimal scale factor and magnifies critical parameter updates before uploading to the server. As a result, the malicious update becomes similar to the benign update, making it difficult for distance-based defenses to identify. Extensive experiments reveal the risk of leaking thousands of images in training diffusion models with FL. Moreover, these experiments demonstrate the effectiveness of AdaSCP in defeating advanced distance-based defenses. We hope this work will attract more attention from the FL community to the critical privacy security issues of Diffusion Models. Code: https://github.com/yuangan/DataStealing.

Main paper: 
 introduction: 
 Federated Learning (FL) has emerged as a popular framework for distributed machine learning due to its local data protection capabilities. Meanwhile, the issue of privacy data leakage in federated learning has attracted significant attention. Most previous FL works focused on discriminative models, and several studies [19, 61, 68] have demonstrated that FL may leak small amounts of arbitrary local data through gradient inversion. Recently, FL has begun to be utilized to train diffusion models [27, 51, 25] , one of the advanced generative methods [22, 48, 45, 58, 11] . In this paper, we found that diffusion models have brought new privacy vulnerabilities to FL. Attackers can steal thousands of specified high-quality local data through diffusion models trained with FL, which exposes more severe privacy security issues compared with discriminative models. Specifically, to safeguard data privacy, using FL to train diffusion models is considered a definitive choice. According to GDPR [52] , strict data privacy management mechanisms should be adopted to prevent attackers from directly accessing or transmitting data from local clients, including banning USB drives, restricting network access, and disabling copy-paste. Nevertheless, these attackers may tamper with the training process of local clients, enabling diffusion models to embed and later extract private images from the released global model, as shown in Fig. 1 . For instance, in an organization with strict data management, one staff can use this method to transmit data to the outside. We refer to this task as DataStealing. The recently emerging Trojan attacks on diffusion models [5, 9, 10] make it possible to steal an image with a specific trigger. This inspires us that multiple triggers may lead to more severe harm and steal thousands of private data. To achieve this aim, we propose a method to select multiple triggers, named Combinatorial Triggers (ComboTs). Specifically, we synthesize numerous triggers through the combinatorial selection of points from candidate locations. Our ComboTs fulfill the requirement for extensive data mapping in DataStealing.Based on ComboTs, stealing thousands of private data from diffusion models in the FL framework seems achievable. However, with the advanced FL defense strategies, injecting multiple backdoors into diffusion models poses greater challenges than introducing a single backdoor. We observe that data poisoning [6, 20, 33] faces difficulties in effectively injecting multiple backdoors into diffusion models under FedAvg [37] . While model poisoning [1] can rapidly inject multiple backdoors by scaling malicious updates, it generally fails to overcome the advanced FL defenses [50, 2, 17, 42, 44, 24] . Although these defenses are designed for classification tasks, distance-based defense methods [2, 17, 44, 24] remain effective in rejecting the malicious update according to the distances between each local update, thereby intensifying the challenge of implanting multiple Trojans into diffusion models.To address the above challenge, we propose an Adaptive Scale Critical Parameters attack (AdaSCP) to effectively circumvent various distance-based defenses [37, 2, 17, 44, 24] . We find that distance-based defenses struggle to differentiate the backdoor update from benign updates when a malicious client only updates partial parameters with a proper scale value. Specifically, we estimate the importance of parameters in the diffusion model in a Taylor expansion framework [39] over dominant timesteps. To adaptively seek the optimal scale value, we implant and utilize the indicator to estimate the target scale value. AdaSCP optimizes the scale factor with a learning rate according to the difference between the target and current scale. Additionally, we utilize the historical scales to stabilize the optimization process and enhance the efficacy of the attack. At last, the attacker trains the critical parameters and uploads the malicious update magnified with the optimized scale value.Overall, our main contributions are summarized as follows:• We introduce a novel task, DataStealing, focusing on data exfiltration from diffusion models within the FL framework. Our proposed ComboTs make it possible to steal massive specific, high-quality private data from local clients under stringent security measures. To our knowledge, we are the first to pay attention to the data privacy leakage risks in federal learning training diffusion models. • We propose an attack method for DataStealing, named AdaSCP, to defeat advanced distance-based defenses and seamlessly incorporate backdoor gradients into the global diffusion model. • Extensive experiments have been conducted to assess the efficacy of current FL Trojan attacks and defenses in DataStealing task. Moreover, our AdaSCP achieves SOTA performance in stealing thousands of private data from the global diffusion model. Our findings illuminate potential future risks to the security of training diffusion models in FL.  
background: 
 Denoising Diffusion Probabilistic Models (DDPMs). DDPMs [22] have garnered considerable interest due to their capacity to generate high-fidelity samples. At the core of DDPMs lies the fundamental principle of modeling the distribution of data through a diffusion process. In this progression, the initial data x 0 undergoes incremental corruption until it eventually converges into a state of complete noise x t with t (1 ≤ t ≤ T ) steps.EQUATIONwhere ϵ ∼ N (0, I) is a Gaussian noise, and ᾱt = t i=1 α i is a hyperparameter that gradually increases the noise level in the forward process. Subsequently, a reverse process works as a denoising operation to retrieve the original data from the noise. This process is defined by a neural network, which is trained to predict the noise ϵ at timestep t. Then, the trained model can gradually denoise random noise to photorealistic images.Diffusion Models in Federated Learning. FL [37] Attacker's Goal. Attacker partition client data into two subsets: {D benign , D backdoor }. The attacker's goal is to extract a large number of training images, D backdoor , from the compromised client via the released global model, as illustrated in Figure 1 . Additionally, the attacker should minimally affect the original model's functionality to preserve the stealth of the backdoor attack.Attacker's Abilities. Under strict data privacy protection, attackers can not upload or download images from the infiltrated client. To achieve the goal of embedding the target data D backdoor into the global diffusion model, the attacker is permitted to enact arbitrary alterations to the training procedure of the diffusion model and the uploaded gradients of the infiltrated client. To streamline the task and facilitate analysis, we focus on scenarios with a single attacker and exclude those with multiple distributed attackers. Considering the difficulty of training diffusion models and the complexity of our task, we assume that the attacker has prior knowledge of the total number of participating clients. 
combinatorial triggers: 
 Conventional backdoor attacks typically use a single trigger, such as a corner patch in the image mask, to generate a target image. However, a fixed trigger is impractical to generate plenty of target images. To tackle this issue, we introduce Combinatorial Triggers (ComboTs) to fulfill the need of mapping multiple target images. Firstly, we choose p candidate points in a grid pattern on the image mask to form the candidate positions. Subsequently, we select q points from the candidate positions in a combinatorial manner. The total number of potential triggers can be determined using the straightforward combination formula: C(p, q). For a 32 × 32 image mask with a pixel spacing of 1, the value of p is 225 when border pixels are excluded. When q is set to 2, the number of ComboTs is 25,200, which fully satisfies our requirements. Furthermore, the ComboTs demonstrate significant scalability: with q set to 3, the potential number of ComboTs can exceed 2 million.Once ComboTs are obtained, they will be utilized as backdoor triggers for training. As shown in Fig. 2 (a), each trigger δ i corresponds to a target image x 0,i . Then we extend the Trojan attack method [5] on the diffusion model from one trigger-target pair to multiple pairs. According to Eq. 1 the forward diffusion process with trigger δ i can be represented as:EQUATIONwhere γ is the blend weight. Trojan noise (γϵ + (1 -γ)δ i ) is a blended image between Gaussian noise ϵ and trigger δ i . Fig. 2 (b) shows the forward and backward diffusion process with one trigger. The sampling process with Trojan noise has been introduced in the literature [5] . The sampling process is extended from one trigger to multiple triggers according to our ComboTs.To achieve an effective attack, model poison [1] is treated as our baseline, which magnifies the updates with a scale value. As Table 1 shows, model poison (scale is N c ) with ComboTs succeed in stealing thousands of data from the FedAvg framework. However, such a brute-force method is ineffective in advanced FL with defense protocol. Two reasons make the attack invalid: 1) The difficulty of training diffusion models with ComboTs requires scaling the malicious updates, which will be easily detected by distance-based defenses [2, 17, 44, 24] .2) The training of the diffusion model will collapse with a high scale value due to its high sensitivity to the gradients.To evade the advanced distance-based defenses, we introduce an Adaptive Scale Critical Parameters attack algorithm (AdaSCP). To alleviate the effect of scaling, AdaSCP estimates and trains critical parameters [14] instead of the whole network (Sec. 3.3.1). As for the second issue, AdaSCP adopts an adaptive scaling policy with an implanted indicator [31] critical parameter mask M G and then find new candidate indicators (Lines 2-5). After that, AdaSCP trains the critical parameters with D benign and D backdoor and scale the critical updates with s r to acquire the scaled malicious model w r (Line 6). Finally, we implant the new indicator to get the indicator-implanted backdoor model w * r , which will be uploaded to the server (Lines 7 and 8).To defeat the advanced defenses with critical parameters in diffusion models, we first adopt the diffusion importance estimation used in the structural pruning task of diffusion model [14] . They claim that numerous noisy and redundant timesteps make minimal contributions to the overall generation in the diffusion process as t approaches T [36, 14] . Hence, our importance scores are estimated with accumulated gradients in dominant timesteps under the Taylor expansion framework [39] . To locate the critical parameters, we sort estimated importance scores and choose a proportion τ to filter important parameters of the diffusion model. The mask M G of critical parameters is then obtained for subsequent training. In the meantime, preparing for finding indicators, we record the absolute value of accumulated gradients | ŵG | and the corresponding Hessian matrix |H G |, which represents the changing direction of gradient updates [67] . More details can be found in Appendix C.1. I ′ ← {I ′ i | M G (I ′ i ) = False} 2: Î = { Î1 , Î2 , ..., Îj } ← arg min Îi∈I ′ θ | ŵG |, Îi 3: I r = {I 1 , I 2 , ..., I m } ← arg min Ii∈ Î θ |H G |, Îi 4: for each I i ∈ I r do M G (I i ) ← True 5: w r ← T1: f ← θ Gr -G r-1 ,I 1 1 k •θ ′ w r-1 -G r-1 ,I 1 ▷ Theorem 1 and 2 in Appendix D 2: tar s ← k-1 f -1 if k-1 f -1 ∈ (0, 2 • N c ] 0otherwise ▷ "Accepted" or "Rejected" by the server wr-Gr,I1 will be merged to form the indicator-implanted backdoor model w * r of this round (Line 7).3: s r ← OptimizeScale(s r-1 , tar s , η, d, his acc , his rej ) ▷ Appendix C.3 4: I r ← RestoreAndDequeueIndicator(k, θ ′ wr-1-Gr-1,I1 , I r-1 ) ▷ Appendix C.Although the implanted indicator can help us judge whether the malicious model is accepted by the FL server or not, the potential of the indicator has not yet been fully tapped. We observe that although the black-box server can ensure that a malicious client is unaware of its weight in the aggregation process, the returned indicator update implies this information. This inspires us to control the weighted average results by adjusting the scale value s r . The optimal scaling factor enables the attacker to circumvent distance-based defenses and seamlessly incorporate backdoor gradients into the global model, bolstering the efficiency and effectiveness of attacking with multiple Trojans. Hence, we design an adaptive algorithm to optimize the scaling factor s r .Algorithm 3 illustrates the procedure of our adaptive scale algorithm. According to the global model G r , we can get the returned indicator update θ Gr-Gr-1,I1 in the (r -1)-th round. At first, we need to define the target scale value tar s according to the returned indicator update. Given n c local updates participating in averaging and the weights λ i for each client, the optimal value of tar s should be nc i=1 λ i /λ adv for poisoning the global updates with the adversary updates. When λ i = 1, tar s equals the number of selected clients n c , which is the optimal scale value used in model poison [1] . But when the indicator-implanted model is rejected by the server, the scale value should approach zero to defeat the defenses. As shown in Line 1 and 2, we can derive tar s with the uploaded and returned indicator updates. We leave the derivation in Appendix D.A natural way is to replace s r with tar s when "Accepted" by the server. However, this is not practical. The derivation of tar s is based on the assumption that the trained updates at the position of indicator θ wi-Gr,I1 are similar across all clients due to the very small gradients. This assumption is not always valid, especially when training with non-IID or backdoor datasets. To reduce the impact of deviation caused by training, we treat (tar s -s s-1 ) as an optimization direction toward the optimal scale value. Hence, we define a learning rate η to optimize the scale value s r . The adaptive scale can defeat some defenses and implant multiple backdoors stealthily. However, some defenses [2] are effective in detecting the scaled malicious updates or diluting them by averaging. This will lead to an unstable training process, where s r fluctuates between 0 and tar s . To stabilize s r and improve the attack effectiveness, we record history scale values in his acc and his rej . They further help determine the optimal value of tar s and s r (Line 3). Additionally, we design a weight decay d for decreasing the learning rate η according to the accepted state in the previous and current rounds. Finally, we restore the indicator value and dequeue the first index I 1 in candidate indicators to prepare for the subsequent operation in the current round (Line 4). More details are provided in Appendix C.3. 
experiments: 
 Datasets and Diffusion Models. We conduct our experiments on three widely-used datasets in generation tasks: CIFAR10 (32 × 32) [30] , CelebA (64 × 64)) [34] and LSUN Bedroom (256 × 256) [62] . We concentrate on Denoising Diffusion Probability Models (DDPMs) [22] . We follow the model replacement attack [1] , injecting backdoor data as training approaches convergence. To simulate the attack process efficiently, we train the diffusion models under the FL framework for CIFAR10 and CelebA. Then we use the pre-trained model for subsequent backdoor experiments. The PGD Poison [53] , and Backdoor-Critical (BC) layer substitution [69] . We set the scale value of model poison as the total number of clients (N c = 5). We train about 80% parameters in our AdaSCP and layers in the BC layer substation for fair comparison. More details can be found in Appendix B.Defenses. To verify the effectiveness of DataStealing methods under defense strategies, we conduct experiments with various distance-based defense methods: FedAvg [37] , Krum [2] , Multi-Krum [2] , Foolsgold [17] , RFA [44] , Multi-metrics [24] . We observe that clipping and adding noise, commonly used in the differential privacy method [13, 42, 50] , will undermine the training of diffusion models. Therefore, we do not consider these defenses in our experiments.Evaluation. We leverage two metrics for evaluating the performance of diffusion models and the efficacy of DataStealing: 1) the Frechet Inception Distance (FID) [21] . 2) Mean Square Error (MSE) between the generated backdoor images and the ground truth images. A lower FID score indicates that To evaluate AdaSCP and attack baselines in DataStealing, we conduct experiments on CIFAR10 [30] ,CelebA [34] and LSUN Bedroom [62] . The target image count is 1,000 for the CIFAR10 dataset, 500 for the CelebA dataset, and 50 for LSUN Bedroom. [53] can overcome all defenses in CIFAR10 by constraining the updates within a limited range. However, the efficiency of this attack remains a significant concern. AdaSCP achieves the balance between stealthiness and efficiency. The results of BC Layer Substitution [69] show that it is not a good choice for poisoning the diffusion model. Ablation on Different Trigger Number. To assess the impact of trigger quantity on DataStealing, we undertook ablation studies with incremental numbers of triggers with AdaSCP. Fig. 4 shows that reducing the number of target images increases the success of attacking. And it is increasingly hard to steal more data. Following a successful theft, the FID tends to remain at a relatively high level. This represents one of the limitations of DataStealing. More experiments are listed in Appendix A. 
discussion on defense mechanisms: 
 To safeguard the training of diffusion models in FL, this section discusses potential defensive mechanisms for future research. First, Multi-Krum has shown strong performance in detecting and diluting malicious updates, preventing attacks from quickly degrading the global model's accuracy. However, as shown in Appendix A.1, its effectiveness diminishes over long-term training, suggesting future enhancements like adaptive thresholds [26] or combining it with other methods [55] . Second, differential privacy methods can invalidate indicators by adding noise or norm clipping while sacrificing generative performance, as discussed in Appendix F. Since AdaSCP requires specific indicators with a large magnification factor, identifying candidate indicators and filtering outliers through comparison could enhance efficiency and effectiveness in defending against DataStealing. Third, the durability experiment in Appendix A.2 demonstrates that backdoors diminish after 100 rounds of continued training with clean data, suggesting a potential mitigation strategy for future work [65, 12] . Finally, as the triggers are embedded in the input noise, releasing only the generated outputs without exposing the global model could serve as an additional defensive strategy. 
related work: 
 Trojan Attacks on Diffusion Model. Trojan attacks [5, 9, 10, 49] on diffusion models have been proposed recently. BadDiffusion [9] and TrojDiff [5] attack DDPMs [22] with an additional trigger term in the forward/backward process. Struppek et al. [49] attacks the text-to-image diffusion models by adding triggers to the text inputs. VillanDiffusion [10] attacks various diffusion models and samplers with image or caption triggers in a unified backdoor framework. In this paper, we show that diffusion models in FL can also be subject to multiple Trojans with combinatorial triggers.More methods [57, 35, 64, 12, 31] focus on backdoor poison with multiple distributed attackers or optimizing the triggers. 3DFed [31] proposes three modules: constraint loss, noise masks, and decoy models. They adjust hyper-parameters of these modules with the acceptance status ("Accepted", "Clipped" or "Rejected") based on the feedback of indicators. However, their indicators and decoy models require collaboration among multiple attackers, which does not align with our task that involves only a single malicious client. We leave DataStealing with multiple distributed attackers for future work.Trojan Attacks on Federated Learning. Since Bagdasaryan et al. [1] point out that the widelyused FL algorithm FedAvg [37]  
conclusion: 
 In this paper, we explored the vulnerabilities of diffusion models within the FL framework, highlighting new avenues for privacy threats through our proposed DataStealing task. Even under rigorous local data protection, substantial private data can be exfiltrated from local clients by employing our ComboTs. Furthermore, we introduce AdaSCP, an adaptive attack method, designed to circumvent advanced distance-based defenses. Our method adaptively seeks the optimal scale value with the indicators. It then trains and magnifies critical parameters, allowing for the seamless integration of backdoor gradients into the global model. Our extensive experiments not only confirm the efficacy of existing FL Trojan attacks and defenses but also highlight the superior performance of AdaSCP in circumventing advanced distance-based defenses. This work serves as a critical reminder of the vulnerabilities in FL and underscores the necessity for continuous advancement in defensive strategies to safeguard against evolving threats in the realm of generative models. We hope our findings will catalyze further research and prompt the FL community to prioritize the development of robust mechanisms to protect privacy in the increasingly complex landscape of machine learning models [38, 59] . 
limitations and ethical statements: 
 Due to the limited page number, we discuss them in Appendix F Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes] Justification: Please refer to Appendix B for the GPU type used in our experiments.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). 
code of ethics: 
 Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes] Justification: The ethical statements can be found in Appendix F.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: Our paper is based on publicly available datasets and models.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: We cited the datasets and codes used in our paper. All datasets and codes used in our paper are publicly available.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. 
 
 Appendix: We conduct more experiments on CIFAR10 to evaluate the performance of AdaSCP with different settings and hyperparameters.We conducted an experiment to demonstrate that existing defense mechanisms struggle to prevent successful attacks by adversaries over extended training periods. While AdaSCP fails to succeed within 300 rounds on CIFAR-10 under the defense of Multi-Krum in Table 1 , the outcome changes when the duration is extended to 1500 rounds. As shown in Fig. 5 , AdaSCP can successfully defeat Multi-Krum defenses given more training time. Furthermore, a longer stable attack is more stealthy and has fewer side effects on the performance of the diffusion model, which is 8.55/0.0088 in round 1,500 compared to the similar result of attacking Foolsgold 24.21/0.0129 in Table 1 .Target image: The durability of a backdoor measures the time span an inserted backdoor continues to be effective after the attacker withdraws. To assess the durability of our AdaSCP attack, we continue training an attacked model (AdaSCP-FedAvg) with benign data and FedAvg protocol. As shown in Fig. 6 , the backdoors implanted by AdaSCP remain effective for approximately 100 rounds. After 100 rounds, the backdoors become almost ineffective as the MSE is higher than 0.1. Moreover, the FID decreases with further training. This suggests a defense strategy for DataStealing: continuing to train with benign data after the initial training can effectively mitigate the impact of multiple backdoors. To better the defense process, we analyze the distance between malicious and mean benign updates under Krum and Multi-Krum defense across different training rounds. Compared to other defense algorithms, Krum and Multi-Krum display more pronounced variations in distance.The results in Fig. 7 show that the initial scale value is substantially higher than the optimal value. This discrepancy causes the initial distance of the malicious updates to be approximately 6.7 times greater than that of the benign updates. As AdaSCP progressively optimizes the scale value, malicious updates gradually align with those benign updates, approaching the optimal relative distance for the attack to bypass the defenses. To evaluate the stability of AdaSCP, we conducted experiments with two additional seeds, resulting in three distinct Non-IID data distributions. Our results are presented as mean ± standard deviation, as shown in Table 4 . The values in the "Mean" row represent the overall mean and standard deviation of the averaged values obtained from the three different seeds. The "Mean" values in Table 4 show a tolerable deviation from the previously reported results, indicating the robustness of our method to variations in Non-IID data distributions. To assess the impact of the proportion τ in selecting critical parameters, we conducted an ablation study presented in Table 5 . The results indicate that more critical parameters lead to better attack performance. However, the performance with τ = 0.99 is as effective as with τ = 0.8, suggesting that some parameters are redundant in attacking. Consequently, we selected τ = 0.4 in other experiments to achieve a trade-off between performance and the critical parameter count, which contains approximately 80% of the parameters. To ensure a fair comparison, we maintain the same percentage of parameters in the BC Layer substitution. Further visual comparisons are presented in Fig. 8 and Fig. 10 . The diversity of content in these targets suggests that our method is applicable across various image types and can achieve superior performance. Moreover, the results indicate that the training of the diffusion model within the FL system reveals greater privacy security vulnerabilities than those observed in discriminative models.Dataset and Implementation Details. We implement all experiments on four 48G NVIDIA A40 GPUs. When estimating the importance score, we adopt a batch size of 64 for CIFAR10 and CelebA, and 3 for LSUN Bedroom. The Non-IID distribution of CIFAR10 and CelebA used in Table 1 are shown in Table 9 . The first client is chosen for attack. The FID/MSE of the pretrained model is 6.24/0.1428 in CIFAR10, 6.00/0.1507 in CelebA, and 9.84/0.2594 in LSUN Bedroom. It needs to be noted that we preprocess the CelebA with the pre-processing code from StyleGAN [28] repository 2 . The batch size is 128 for CIFAR10, 64 for CelebA and 8 for LSUN Bedroom.PGD Poison. Projected Gradient Descent (PGD) attack [53] guarantees that the malicious model sent by the attacker would not be rejected by the norm-based defenses when the norm of updates is less than a radius. We note that the original radius is too small to attack the diffusion model. Hence, we set the radius as 8 to achieve a tradeoff between the effectiveness and stealthiness of the PGD attack.BC Layer Substitution. To defeat the advanced defenses in classification tasks, critical layers [69] are effective. However, DataStealing poses two challenges in estimating the critical layers: 1) There is no such efficient metric as Backdoor Success Rate (BSR) to justify the importance of every layer. The low sampling efficiency of diffusion models makes such a method impractical.2) The diffusion model exhibits a substantially increased layer number relative to previously employed architectures like ResNet18, which further increases the difficulty in finding critical layers. Hence, for the BC layer substitution attack, we adopt the momentum-based importance score [46, 15] to identify the critical layers. Algorithm 4 demonstrates the process of estimating the parameter importance with accumulated gradients in dominant timesteps under the Taylor expansion framework, as described in the literature [14] . The timesteps used to estimate the importance score have higher loss values than the others. Hence, we refer to these timesteps as dominant timesteps (Line 7). After estimating the importance score of the diffusion model, we create a mask of critical parameters M G with the top τ structural elements from all scores (Line 15). While estimating the importance score, we record the accumulated gradients | ŵG | and their Hessian matrix |H G | to subsequently find indicators (Lines 11-12 and 16-18).Input: Indicator-restored global model w G and its parameter θ, parameters for finding indicators θ, benign datasets D benign , a threshold T , a proportion τ Output:Accumulated gradients | ŵG |, Hessian matrix |H G |, critical parameter mask M G 1: L max ← 0 2: x 0 ∼ D benign , ϵ ∼ N (0, 1) 3: for t in [0, 1, 2, . . . , T ] do 4: x t ← √ α t x 0 + √ 1 -α t ϵ 5: L t ← ∥ϵ -ϵ θ (x t , t)∥ 2 ▷ Loss of diffusion model 6: L max ← max(L max , L t ) 7: if L t /L max ≤ T then ▷ Consider dominant timesteps in diffusion model 8: break 9:end if 10:∇ θij L t (θ, x 0 ) ← back-propagation(L t (θ, x 0 )) ▷ Taylor expansion 11:Grad θ,t ← autograd( θ) ▷ Gradient for finding indicators 12:Hess θ,t ← autograd(Grad θ,t ) ▷ Hessian matrix for finding indicators 13: end for 14: I(θ i , x) ← j |θ ij • t s=0 ∇ θij L s (θ, x 0 )| ▷ Structuralx 0 ∼ D benign , (x 0 , δ i ) ∼ D backdoor 3: t, t ∼ Uniform({1, . . . , T }) 4: x t ← √ α t x 0 + √ 1 -α t ϵ ▷ Benign noise 5: xt,i ← √ α t x0,i + √ 1 -α t (γε + (1 -γ)δ i ) ▷ Trojan noise 6: ẍt ← [x t , xt,i ], ẗ := [t, t], ε := [ϵ, ε] 7:∆θ ← Take the gradient step on∇ θ ∥ε -ϵ θ (ẍ t , ẗ)∥ 2 ▷ θ is the trainable parameters 8:∆θ ′ ← {∆θ i | M G (i) = True} 9:θ ← θ + ∆θ ′ ▷ Only update critical parameters 10: until reach the sample limits in one round 11: w r ← w G + s r • ∆θ ′ ▷ Scale the updates of critical parameters 12: return w rAlgorithm 5 illustrates the process of training the critical parameters with benign dataset and backdoor dataset. We train benign and backdoor data in one batch (Line 2-7). With Eq. 1 and Eq. 2, we add benign noise and Trojan noise into the corresponding data. After training the diffusion model, we only update the critical parameters with the mask M G (Line 8 and 9). Finally, we scale the accumulated malicious updates with s r and return the scaled model w r .Algorithm 6 illustrates the process of optimizing the scale value according to the estimated target scale value and history scale values. According to the purpose of tar s , demonstrated in Eq. 5, the scale value is better to be close to tar s . Hence, when "Accepted" by the server, the previous scale value s r-1 can defeat the defense and should move toward tar s to achieve better attacking performance (Line 1-5). To prevent tar s from greatly exceeding the previously rejected scale, the 20th percentile value of the sorted his rej is used as the upper boundary for tar s , as illustrated in Algorithm 7. Then we optimize the scale value with the current optimal target tar * s (Line 4) and set the flag of the previous accepted state Accept pre to True.When "Rejected" by the server, tar s will be set to 0 and the scale value should be decreased to defeat the defenses (Line 7-11). To avoid the optimized scale s ′ r being significantly lower than the accepted scales, we find the optimal scale with Algorithm 8. Specifically, the medium value of the sorted his acc is adopted as the lower bound for s r . If a malicious update was previously "Accepted" but is now "Rejected", we reduce the learning rate by multiplying it with a weight decay factor. This adjustment is made based on the value of the flag Accept pre . Finally, we set the flag of the flag Accept pre to False. Accept pre ← T rue 6: else ▷ "Rejected" then decrease the scale 7:Append s r-1 to his rej then sort his rej ascending Proof of Theorem 1: According to the aggregation process of FL [37, 50] , the server updates the global model with the updates from clients. To simplify the analysis, we assume the learning rate of the server is 1. Given n c clients participating in the aggregation, we can get the server's updating equation:EQUATIONwhere W i represents the trained local model in the i-th client, and λ i is the weight for averaging. To simplify the notation, let ∆θ i denote the update of the local model θ Wi,r-1-Gr-1 . Then the updating of the server can be represented as:G r -G r-1 = nc i λ i ∆θ i nc i=1 λ i (4)To proof that nc i=1 λ i /λ adv is the optimal scale value, we scale the adversary updates to nc i=1 λi λ adv ∆θ adv . Then we can get:G r -G r-1 = ∆θ adv + nc i=2 λ i ∆θ i nc i=1 λ i (5)When training converges, ∆θ i is approaching zero and the global updates can be replaced by the malicious updates ∆θ adv .Theorem 2: Since the gradient and curvature are approaching zero, we assume that the training update at indicator I 1 is similar in every client. Under the assumption, the target scale valuenc i=1 λ i /λ adv = k-1 f -1 , where f = θ Gr -G r-1 ,I 1 1 k •θ ′ w r-1 -G r-1 ,I 1, when the indicator-implanted malicious model is "Accepted" by the server.Proof of Theorem 2: We will derive the target scale value nc i=1 λ i /λ adv according to the implanted indicator. Given the indicator I 1 , we can get the returned indicator update θ Gr-Gr-1,I1 . Let ∆θ G,I1 represent θ Gr-Gr-1,I1 and ∆θ ′ adv,I1 denote the uploaded indicator update θ ′ wr-1-Gr-1,I1 . We can get the following equation:EQUATIONwhere ∆θ ′ adv,I1 = k∆θ adv,I1 as the training update at I 1 is magnified by k to form the implanted indicator. Since the gradient and curvature are approaching zero at position I 1 , we assume the training update ∆θ i,I1 between each client is similar. Then Eq. 7 can be re-written as:EQUATIONBy rearranging Eq. 8, the target scale value nc i=1 λ i /λ adv can be derived:EQUATIONEQUATIONwheref = ∆θ G,I 1 θ adv,I 1 = θ Gr -G r-1 ,I 1 1 k •θ ′ w r-1 -G r-1 ,I 1, which is used in the Algorithm 3 Line 1. In our experiments, k is set to 50. When "Rejected" by the server, ∆θ G,I1 is nearly equal to θ i,I1 and f is close to 1 under our assumption. Considering the deviation introduced by training, the result of Eq. 11 is either a negative or a very large number. Hence, we set the "Accepted" range to (0, 2 • N c ]. Then the equation of target scale value tar s is:EQUATION)The equation is used in the Algorithm 3 Line 2. As illustrated in Sec. 3.3, we will optimize the scale value according to the results of tar s . While our framework aims to enhance the robustness of diffusion models in FL, we recognize the potential for misuse of our findings in more computer vision tasks [18, 32, 54, 38, 59] . Nonetheless, raising awareness about this issue can lead to the adoption of stricter security standards in the design and implementation of training diffusion models with FL, thereby minimizing the risks of data breaches and misuse. We hope our red-teaming effort can draw more attention from the federated learning (FL) community to the critical privacy security issues associated with diffusion models.• It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.Justification: We acknowledge the Code of Ethics and obey them in our paper.Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).https://github.com/NVlabs/stylegan/blob/master/dataset_tool.py#L484-L499 


Decision: The paper identifies a new threat of data extraction from diffusion models trained with federated learning.  The combinatorial trigger methodology was appreciated by the reviewers as a creative design, as was the use of adaptive scale critical parameters. The paper was clearly written, and the experiments were overall convincing to the reviewers (though experiments can always be expanded). Please do make sure to include your updated results on the LSUN bedrooms dataset. On my own reading of the paper, I was curious how the method works against other distance-based defenses tailored to FL, such as Wang et al "Towards a defense against federated backdoor attacks under continuous training". Overall, the paper presents a solid step in deepening our understanding of adversarial attacks in the federated setting, particularly for diffusion models.

Reviews: review: paper_summary: paper_summary: This paper studies the privacy risks of diffusion models in federated learning (FL) through the lens of data stealing attacks. The authors propose the ComboTs method to target a large amount of images. To further defeat advanced distance-based FL defenses, the authors propose the AdaSCP attack method which adaptively scales the critical parameters in the updating process. The evaluation results demonstrate the effectiveness of this attack.
strength_weakness: strength_weakness: - Problematic attack settings
- Insufficient experiments and explanations
questions: questions: This paper explores the data leakage risks of diffusion models in federated learning. The authors conduct the data stealing attack via backdoor attacks. To target a large amount of images and bypass the advanced FL defenses, the authors propose the ComboTs and AdaSCP methods, respectively. The evaluations showcase the effectiveness of the proposed data stealing attack.  

However, there are still some critical issues.

- The attack settings are problematic. In this paper, the attacker is assumed to have access to the training dataset of the poisoned client, such that the attacker can insert the backdoor triggers into the target images, and finally the attacker will be able to recover the target images according to their backdoor trigger patterns. However, since the attacker already has access to the target images, why bother stealing them using the proposed complex methods? Just because of the so-called "Under strict data privacy protection, attackers can not upload or download images from the infiltrated client" in Section 3.1? This assumption does NOT make any sense. The attacker can even check every pixel value of the target image to locally reconstruct it without downloading it from the client. I would suggest the authors clearly re-explain the motivation and the settings of the attack. 

- The authors mentioned the FID metric to measure the performance of diffusion models. However, the authors did not clearly claim either higher or lower FID is better. Furthermore, when discussing the evaluation results, the authors only focused on the MSE score. I would suggest the authors elaborate more on this metric if they use it as an evaluation metric. 

- The authors only conduct the experiments on two image datasets with low resolutions. I would suggest the authors also evaluate the performance of their attack on another dataset with a much higher resolution, e.g., a subset of ImageNet.
limitations: limitations: See my detailed questions
paper_summary: paper_summary: The paper titled "DataStealing: Steal Data from Diffusion Models in Federated Learning with Multiple Trojans" investigates a novel privacy vulnerability in federated learning (FL) when training diffusion models. The authors introduce a new attack methodology named DataStealing, which leverages multiple Trojans to exfiltrate private data from local clients. The attack utilizes Combinatorial Triggers (ComboTs) to map extensive data and proposes the Adaptive Scale Critical Parameters (AdaSCP) attack to bypass advanced FL defenses.

**Key Contributions:**
* 1\. **Identification of Vulnerability**:

    - The paper identifies a new privacy threat in FL where diffusion models can leak substantial private data. Despite stringent privacy measures, attackers can exploit these models to steal high-quality local data.

* 2\. **Combinatorial Triggers (ComboTs)**:

    - A method to select multiple triggers for backdoor attacks, significantly increasing the capability to map and steal large amounts of private data.

* 3\. **Adaptive Scale Critical Parameters (AdaSCP)**:

    - An attack strategy that evaluates and scales critical parameter updates, making the malicious updates indistinguishable from benign ones. This circumvents distance-based defenses effectively.

* 4\. **Experimental Validation**:

    - Extensive experiments demonstrate the ability of the proposed methods to leak thousands of images from training diffusion models in an FL setup. AdaSCP is shown to be highly effective against advanced FL defenses.

**Conclusion**:

The paper highlights the severe privacy risks associated with training diffusion models in FL and calls for more robust defensive measures to protect against such vulnerabilities. The findings emphasize the need for continuous advancements in FL security to safeguard private data.
strength_weakness: strength_weakness: **Weaknesses of the Paper**

**Limited Discussion on Defense Mechanisms**

- **Lack of Proactive Defense Strategies**: While the paper thoroughly explores the vulnerabilities and proposes robust attack methodologies, it falls short in discussing proactive defense mechanisms. It would significantly benefit from suggesting or exploring potential defense strategies to mitigate the identified vulnerabilities. Including a section on how to strengthen FL systems against such attacks would provide a more balanced view.

**Depth of Contextualization**
- **Comparative Analysis with Prior Work**: Although the paper positions its contributions within the broader context of federated learning and privacy security, a deeper comparative analysis with specific prior studies would enhance its impact. For example, more detailed comparisons with existing backdoor and Trojan attack methodologies would help in highlighting the advancements made by this work.
- **Exploration of Related Work**: The related work section could be expanded to include a more comprehensive review of similar vulnerabilities in federated learning and generative models. This would help in better contextualizing the novelty and significance of the proposed methods.

**Experimental Scope**
- **Scalability and Generalizability**: While the experiments are robust, they are limited to specific datasets (CIFAR10 and CelebA) and certain configurations (IID and non-IID distributions). Exploring the scalability and generalizability of the proposed attack methodologies to other datasets and real-world scenarios would strengthen the empirical validation. For instance, including more diverse datasets or different FL frameworks could provide insights into the broader applicability of the findings.

- **Extended Analysis of Parameters**: The paper briefly touches upon the impact of various parameters, such as the proportion of critical parameters and patch sizes in ComboTs. A more detailed and systematic analysis of how these parameters influence the attack's effectiveness across different settings would be beneficial. Including ablation studies on a wider range of parameters and configurations would offer a deeper understanding of the methods' robustness.

**Presentation Improvements**

- **Simplifying Technical Explanations**: Some sections of the paper, particularly those explaining the technical details of the methodologies, could be simplified for better readability. This would make the paper more accessible to a broader audience, including those who may not have a deep technical background in the specific area.

- **Enhanced Flow and Readability**: Improving the flow and readability of certain sections, particularly the methodology and experiment results, would enhance the overall presentation. Ensuring smoother transitions between sections and sub-sections would maintain the reader’s engagement and comprehension.

**Specific Suggestions for Improvement**

* 1\. **Incorporate Proactive Defense Mechanisms**: Add a section discussing potential defense strategies to mitigate the vulnerabilities identified. This could include theoretical approaches, proposed defense mechanisms, or an exploration of existing techniques that could be adapted.
* 2\. **Expand Comparative Analysis**: Deepen the comparative analysis with prior work, providing detailed discussions on how the proposed methods advance the state-of-the-art in backdoor and Trojan attacks in FL.
* 3\. **Broaden Experimental Validation**: Expand the experimental scope to include more diverse datasets and configurations. Conduct a systematic analysis of various parameters influencing the attack's effectiveness, with detailed ablation studies.
* 4\. **Simplify and Enhance Readability**: Simplify technical explanations where possible, and improve the overall flow and readability of the paper. This could involve rephrasing complex sections and ensuring smooth transitions between different parts of the paper.

By addressing these weaknesses, the paper can further solidify its contributions and provide a more comprehensive and impactful addition to the research area.
questions: questions: **Questions and Suggestions for the Authors**

**Questions**

* 1\. **Defense Mechanisms**:

    - What proactive defense strategies do you suggest to mitigate the vulnerabilities identified in the paper? Have you considered evaluating existing defense mechanisms or proposing new ones specifically tailored to counter the DataStealing attack?

* 2\. **Comparative Analysis**:

    - Can you provide a more detailed comparative analysis with specific prior studies on backdoor and Trojan attacks in federated learning? How do your proposed methods significantly advance the state-of-the-art compared to these existing approaches?

* 3\. **Scalability and Generalizability**:

    - How do you anticipate your proposed attack methodologies (ComboTs and AdaSCP) will perform on more diverse datasets and in real-world scenarios? Have you considered evaluating your methods on other datasets or federated learning frameworks to validate their scalability and generalizability?

* 4\. **Parameter Sensitivity**:

    - Can you provide a more systematic analysis of how different parameters (e.g., proportion of critical parameters, patch sizes in ComboTs) influence the effectiveness of the attacks? Detailed ablation studies on these parameters would be beneficial for understanding the robustness of your methods.

* 5\. **Complexity and Computation**:

    - What are the computational costs and complexities associated with implementing your proposed methods (ComboTs and AdaSCP)? How feasible is it to execute these attacks in practical settings, considering the required computational resources and time?

**Suggestions**

* 1\. **Proactive Defense Strategies**:

    - Include a dedicated section discussing potential defense strategies to mitigate the vulnerabilities identified. This could involve theoretical approaches, proposed defense mechanisms, or an exploration of existing techniques that could be adapted to counter DataStealing.

* 2\. **Enhanced Comparative Analysis**:

    - Deepen the comparative analysis with prior work, providing detailed discussions on how your proposed methods advance the state-of-the-art in backdoor and Trojan attacks in federated learning. This can help in better contextualizing the novelty and significance of your contributions.

* 3\. **Broaden Experimental Validation**:

    - Expand the experimental scope to include more diverse datasets and configurations. Conduct a systematic analysis of various parameters influencing the attack's effectiveness, with detailed ablation studies. This would strengthen the empirical validation and demonstrate the broader applicability of your findings.

* 4\. **Simplify Technical Explanations**:

    - Simplify the technical explanations where possible to make the paper more accessible to a broader audience, including those without a deep technical background in the specific area. This would enhance the overall readability and impact of the paper.

* 5\. **Detailed Discussion on Limitations**:

    - Include a more detailed discussion on the limitations of your proposed methods. Address potential challenges and constraints in implementing the attacks, and suggest future research directions to overcome these limitations.

By addressing these questions and suggestions, the authors can provide a more comprehensive and impactful contribution to the research area, enhancing the clarity, robustness, and significance of their work.
limitations: limitations: **Assessment of Limitations and Potential Negative Societal Impact**

**Addressed Limitations**

* 1\. **Technical Limitations**:

    - The authors briefly mention the limitations related to the computational complexity and scalability of their proposed methods. They acknowledge the challenges in training diffusion models with ComboTs and the sensitivity of these models to gradient updates.

* 2\. **Experimental Constraints**:

    - The paper indicates that the experiments were conducted on specific datasets (CIFAR10 and CelebA) and acknowledges the need for further validation on more diverse datasets and real-world scenarios.

* 3\. **Defensive Measures**:

    - There is a mention of the need for further research to develop robust defensive mechanisms against the identified vulnerabilities in federated learning, suggesting an awareness of the current gap in defensive strategies.

**Potential Negative Societal Impact**

* 1\. **Privacy and Security Risks**:

    - The paper highlights significant privacy risks associated with federated learning, especially when training diffusion models. The authors acknowledge the potential misuse of the proposed attack methodologies to steal private data, underscoring the importance of addressing these vulnerabilities to protect user privacy.

**Constructive Suggestions for Improvement**

* 1\. **Detailed Discussion on Limitations**:

    - The authors should provide a more comprehensive discussion on the limitations of their proposed methods. This could include:

        - A deeper exploration of the computational costs and complexities associated with implementing ComboTs and AdaSCP.

        - An assessment of the scalability and generalizability of the proposed methods across different datasets and federated learning frameworks.

        - Potential challenges in deploying these attacks in real-world scenarios, considering practical constraints and resource limitations.

* 2\. **Proactive Defense Strategies**:

    - Include suggestions or preliminary evaluations of potential defense mechanisms to counter the DataStealing attack. This would provide a more balanced view and contribute to advancing the field by not only identifying vulnerabilities but also proposing ways to mitigate them.

* 3\. **Ethical Considerations and Responsible Disclosure**:

    - The authors should discuss the ethical considerations and responsible disclosure practices followed in conducting this research. This could include:
        - Steps taken to ensure that the research does not cause harm.
        - Collaboration with organizations or communities to address the identified vulnerabilities responsibly.
        - Suggestions for policy or regulatory measures to protect against the misuse of such attack methodologies.

* 4\. **Broader Societal Impact**:

    - Expand on the broader societal impact of the research by discussing:
        - How the findings could influence the development of privacy-preserving technologies in federated learning.
        - The implications for industries and applications relying on federated learning, such as healthcare, finance, and IoT.
        - Potential benefits of raising awareness about these vulnerabilities to foster more robust and secure machine learning practices.

**Conclusion**

The authors have made a good start in addressing the limitations and potential negative societal impacts of their work. By providing a more detailed discussion on these aspects and incorporating the constructive suggestions above, the authors can enhance the comprehensiveness and responsibility of their research. This approach would contribute positively to the field and ensure that the research is conducted and presented in an ethically sound and impactful manner.
paper_summary: paper_summary: The paper introduces a novel attack method named DataStealing, which exploits vulnerabilities in diffusion models trained in Federated Learning (FL) systems. The authors highlight that diffusion models, despite their advanced capabilities in data generation, present new privacy threats when integrated with FL. They propose a method called Combinatorial Triggers (ComboTs) to steal images by embedding multiple backdoors in the diffusion models. To counteract distance-based FL defenses, they introduce an Adaptive Scale Critical Parameters (AdaSCP) attack that evaluates the importance of parameters and adaptively scales malicious updates to evade detection. Extensive experiments validate the effectiveness of AdaSCP in stealing private data from diffusion models.
strength_weakness: strength_weakness: Weaknesses:

1. Defense Mechanisms: A discussion on potential defense mechanisms or mitigations would make the work have better impacts in this area and further highlight the significance of the threat.

2. Assumptions: In the experiments, the proportion of malicious clients is 1/5, which might not be realistic in real practice.

3. More Experiments: The attack is evaluated on two datasets (CIFAR10 and CelebA). Expanding the evaluation to include more diverse datasets could further support the work.
questions: questions: NA
limitations: limitations: The authors discussed the limitations and potential negative societal impact of the work in Appendix.
paper_summary: paper_summary: This paper identifies a pioneering privacy threat in Federated Learning (FL) introduced by popular diffusion models, called DataStealing. The researchers show that an attacker can use Combinatorial Triggers (ComboTs) to steal private data from a client in vanilla FL, even with strict data management protocols in place. For advanced FL systems, they propose an attack method (AdaSCP) to bypass distance-based defenses by adaptively scaling critical parameter updates with indicators. Extensive experiments demonstrate that AdaSCP not only circumvents existing defenses but also successfully steal thousands of images from the system. The paper calls for increased attention to privacy issues in diffusion models within the FL community.
strength_weakness: strength_weakness: 1. The reason that Model Poisoning cannot bypass the defenses is only demonstrated in Section 3.3. More quantitative analysis, including details of defending against malicious updates with different attack methods, can enhance understanding. A figure is also acceptable.
2. The error bars are not reported. Although it will require significant computational resources, I recommend conducting repeat experiments with different seeds, at least for the proposed AdaSCP. This will enhance the academic quality of this paper.
3. The recent studies [1, 2, 3] should be discussed in the related work.
4. Some minor typos:
- “..”->”.” in line 200.
	- “front” should be “first” to keep consistent in Algorithm 2 line 6.
[1] Jia J, Yuan Z, Sahabandu D, et al. FedGame: a game-theoretic defense against backdoor attacks in federated learning[J]. Advances in Neural Information Processing Systems, 2024, 36.
[2] Cheng S, Tao G, Liu Y, et al. Lotus: Evasive and resilient backdoor attacks through sub-partitioning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 24798-24809.
[3] Huang J, Hong C, Chen L Y, et al. Gradient Inversion of Federated Diffusion Models[J]. arXiv preprint arXiv:2405.20380, 2024.
questions: questions: Please see the weakness part.
limitations: limitations: Please see the weakness part.

Comments: comment: We appreciate the authors' patience and thorough rebuttal. After careful consideration and review, we decide to maintain the original score.