Paper: FedInverse: Evaluating Privacy Leakage in Federated Learning (ICLR-2024)

Reviewer comment (Novelty):
The work is based on the bold premise that "no studies pay attention to the data leakage problem when the attackers are pretended to be benign users", i.e., data extraction from the global models that are distributed by the central server in each round. While this might be true, a dedicated discussion of related works is missing from the main body of the paper (and only provided in Appendix B). There definitely exist works that look into data extraction from the global model, but from the perspective of a malicious aggregator that can use techniques like providing inconsistent models. For example: Boenisch et al. (arXiv:2301.04017), Pasquini et al. (CCS'22), Zhao et al. (SP'24).

Author response:
#### **Thank the reviewer's comments and suggestions. We will answer the weakness and question one by one in this rebuttal. We will include rebuttal discussions in the updated version to make the final version more clear to our readers. We hope the answers below solve your concerns. If your concerns were not cleared, please let us know, and we'll try to clarify them further. We also hope you can re-evaluate our paper based on the answers and consider raising your score.**

#### For W1, We will add a related works summary into the main context and move some of the experiment results into the Appendix. We have further studied the suggested papers as follows and will add them to the related works. 
#### The paper ```[13]``` discusses the "gradient suppression attack", a method where a malicious server exploits model inconsistencies to bypass Secure Aggregation and extract a specific user's model update. Central to this attack is the "dead-layer trick," which manipulates ReLU layers by inducing the dying-ReLU phenomenon, where a network's parameter derivatives become zero. This is achieved through malicious parameters that exploit the ReLU function's non-differentiability, allowing the server to nullify the model updates of non-targeted users. Consequently, the server isolates and leaks the targeted user's model update, undermining the integrity of the model training process.
#### The paper ```[14]``` investigates an attack on Federated Learning (FL) systems that use Distributed Differential Privacy (DDP) and Secure Aggregation (SA). The attack involves circumventing SA by introducing Sybil devices, controlled by the server, into the FL process. These devices manipulate the outcome by returning arbitrary gradients, allowing the server to isolate and extract the target user's gradients. The paper also points out the limitations of DDP, where the noise added for privacy is often insufficient, especially compared to Local Differential Privacy. By exploiting these vulnerabilities, the attacker can reconstruct individual users' training data. The paper discusses using "trap weights" to create redundancy in the data, facilitating higher-fidelity reconstruction. Experiments with datasets like CIFAR10 and IMDB demonstrate the attack's effectiveness, using techniques like similarity clustering and leveraging gradient sparsity to improve the quality of reconstructed data. The study further notes that higher gradient norms lead to more significant data leakage, which the attack exploits. This comprehensive analysis reveals critical weaknesses in FL systems enhanced with DDP and SA, showing that private user data can still be extracted despite these privacy measures.
#### The paper ```[15]``` presents a sophisticated attack in Federated Learning (FL) environments, greatly surpassing previous methods in data leakage efficiency. LOKI can leak 76-86% of data samples in a single training round, targeting both FedAVG and FedSGD systems. The attack, designed for a cross-device FL setting with secure aggregation, manipulates the model architecture and parameters, enabling data recovery from hundreds of clients. A key tactic is using customized convolutional kernels to create separate identity mapping sets, maintaining distinct weight gradients for different clients. LOKI resolves scalability issues in FedAVG by introducing a convolutional scaling factor (CSF), which aids in precision during reconstruction and addresses neuron activation overlap. The attack also cleverly utilizes biases in the FC layer to learn and utilize data characteristics like average pixel intensity. This technique enables the identification of data ownership post-aggregation and requires significantly fewer parameters compared to previous methods, enhancing efficiency. LOKI is effective even in the absence of full model inconsistency among clients, marking a significant advancement in data reconstruction techniques in FL systems.

Reviewer comment (Novelty):
The application of the existing model inversion attacks seems rather straightforward, assumes that a good auxiliary dataset is available, and the proposed diversity optimization in the evaluation does not show impressive improvements over the respective baselines.

Author response:
#### The lack of publicly available data is the current challenge for most model-inversion attackers and limits the usefulness of not only our proposed method but also most of the other public-data-assisted generative models, including GMI, KED-MI, and VMI. For evaluation purposes, FedInverse uses very limited similar but different distributed public data to launch the model inversion attacks in our FL settings. This is more realistic in real-world applications because there are still available public data that have similar but not the same distribution to the targeted data from the global model. For example, the experiments in **Appendix A.2** have been conducted using FMNIST and EMNIST as the public datasets to generate the data from MNIST. 

#### The experiment of diversity optimization is important to help us evaluate the vulnerability of FL under the model inversion attack via the diversity of the generated data. The results show that diversity optimization can achieve higher improvements in attack, as well as results that are at least not inferior to those without optimization. For example, some improvements show in the **Appendix A** in **Table 3** from **52.00** to **58.00** when we use FMNIST as the public dataset, **Table 4** from **86.83** to **99.80** when we use FMNIST as the public dataset, **Table 7** from **52.00** to **60.00** when (E,B) = (2, 60), **Table 8** from **78.89** to **85.09** when (E,B) = (2, 10), and **Table 17** from **60.00** to **82.80** when (E,B) = (30, 128) etc.

Reviewer comment (Presentation):
The presentation and positioning of the suggested FedInverse framework is rather unclear. On the one hand, it is presented as an attack; on the other hand, it is presented as an evaluation framework, raising the question of whether it is supposed to be something that FL operators should also utilize to measure whether real benign clients might be vulnerable to such attacks.

Author response:
#### Our work aims to evaluate the boundaries of privacy protection in the whole FL system from the client's perspective, whether the client can obtain data from other clients. From the reviewer's suggestions and comments, we can evaluate that the FL task can be considered secure, with no public datasets attackers can leverage. Therefore, evaluating privacy boundaries under model inversion attacks in FL is important for the FL research community.

#### Only a single attacker participates in the FL to pretend to be a benign client in each communication round. We have made the changes to emphasize only one single attacker will join the FL in each communication round in **Algorithm 1**. In line 19, the set Q_t has been replaced by N, representing a Gaussian distribution. Please check the updated algorithm in **Algorithm 1** in the **Rebuttal Revision**. The final results of the **Algorithm 1** will be relevant evaluation results on Q_t across all communication rounds.

Reviewer comment (Experiments):
FedInverse uses typical model inversion attacks to generate the images. However, whether those approaches could be directly applied to the aggregated model is still a problem. In the setting of the experiments, the clients have local datasets that are disjoint on the label (for example, in MNIST, the attacker has labels 5-9, while other clients have labels 0-4). However, the setting is not practical for the typical situation. As the number of participants increases, some clients will have similar data distributions, so that FedInverse may fail in this setting.

Author response:
#### FedInverse indeed generates data from the aggregated global model, where the client receives the aggregated global model from the central server and launches the attack on the global model just like the reviewer summarized in the Summary. In FedInverse, we evaluate the performance of MI attacks in FL settings to reveal data with totally different labels owned by the attackers from the aggregated global model.

#### In addition, it should be noted that our experimental data settings follow the same setting in ```[1]``` ```[2]``` ```[3]``` because this setting is widely known as more challenging than the reviewer-suggested setting of revealing information about clients who have overlapped labels. We provide the detailed work process of FedInverse in **Subsection 3.1, Algorithm 1, and Figure 2**, and **Section 4** elaborates on our experimental settings. Therefore, FedInverse will not fail in the reviewers-suggested setting. 

#### ```[1]``` Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 253–261, 2020. 
    
#### ```[2]``` Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16178–16187, 2021.

#### ```[3]``` Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1358–1367, 2022.

Reviewer comment (Evaluation):
Moreover, FedInverse generates the image from a similar distribution with target clients. However, it could not tell the source of the image exactly (from an attacker or another specific participant).

Author response:
#### FedInverse is designed to generate images from a distinct distribution unrelated to potential attackers, not from a similar distribution. In **Appendix A.2**, we even test how FedInverse can generate MNIST data from the FL aggregated model using a different dataset with entirely different labels, such as FMNIST ```[1]``` and EMINST ```[2]```. Additionally, FedInverse's main contribution lies in evaluating privacy leakage in FL, regardless of whether it originates from attackers or other participants. This contribution has been recognized and supported by all other reviewers.
   
#### ```[1]``` Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.

#### ```[2]``` Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (IJCNN), pp.2921–2926. IEEE, 2017.

Reviewer comment (Evaluation):
Some metrics used in the experiments should be clear. Take the attack accuracy as an example. A well-trained model may still classify an image with some flaw as the correct class, and it could lead to results at variance with reality. Additionally, the top-5 accuracy is too weak for some experiments, especially on MNIST (with only ten labels). As for FID, the attack results of some baseline approaches (for example, applying the MI attack on local models) should be added for comparison. Otherwise, it would be hard for readers to understand the degree of privacy leakage.

Author response:
#### We have compared to the SOTA baseline ```[1]``` ```[2]``` ```[3]``` ```[4]``` ```[5]``` and followed the attack accuracy used by the prior works. We didn't find more recent works on the problem mentioned by the reviewer. The metrics, such as top-5 accuracy and FID, as well as the datasets we used, such as CelebA ```[6]```, CIFAR-10 ```[7]```, and MNIST ```[8]```, have been used by almost all evaluations for MI ```[1]``` ```[2]``` ```[5]```. This is because CelebA is a very large dataset that contains 10,177 identities, 202,599 face images, and 5 landmark locations, 40 binary attribute annotations per image, where top-5 accuracy is an important metric for evaluation on this large dataset. The datasets of CIFAR-10 and MNIST provide the additional evaluation of small datasets. For the FID value, it is calculated to evaluate the similarity between generated images and real images, while the real images come from the original dataset not owned by attackers for experimental evaluation only. The metrics are very important to evaluate and compare the MI attack performance when the SOTA defense mechanism ```[5]``` has been deployed in the FL settings. 
    
#### ```[1]``` Yuheng Zhang, Ruoxi Jia, Hengzhi Pei, Wenxiao Wang, Bo Li, and Dawn Song. The secret revealer: Generative model-inversion attacks against deep neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 253–261, 2020. 
    
#### ```[2]``` Si Chen, Mostafa Kahla, Ruoxi Jia, and Guo-Jun Qi. Knowledge-enriched distributional model inversion attacks. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16178–16187, 2021.
    
#### ```[3]``` Kuan-ChiehWang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. Advances in Neural Information Processing Systems, 34:9706–9719, 2021.
    
#### ```[4]``` Tianhao Wang, Yuheng Zhang, and Ruoxi Jia. Improving robustness to model inversion attacks via mutual information regularization. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pp. 11666–11673, 2021.

#### ```[5]``` Xiong Peng, Feng Liu, Jingfeng Zhang, Long Lan, Junjie Ye, Tongliang Liu, and Bo Han. Bilateral dependency optimization: Defending against model-inversion attacks. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pp. 1358–1367, 2022.

#### ```[6]``` Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730–3738, 2015.

#### ```[7]``` Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

#### ```[8]``` Yann LeCun, L´eon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998.

Reviewer comment (Writing):
In Section 3, the description of the attack procedure is not clear enough. More details are needed.

Author response:
#### There are no concerns from other reviewers on the current description of our attack procedure. Could you please specify which details should be further added? We will explain the details based on your detailed questions.

Reviewer comment (Experiments):
How does FedInverse perform in a typical vertical FL setting? For example, 10+ clients with the same (or similar) data distribution. More discussions of this case should be given.

Author response:
- #### Our work follows the recent SOTA works with the same FL setting, such as ```[1]``` ```[2]``` ```[3]``` ```[4]``` ```[5]``` ```[6]``` ```[7]``` ```[8]``` ```[9]``` ```[10]``` etc., which is a significant contribution to the research area and recognized by other reviewers. Vertical FL is a completely different FL framework. It is a good suggestion to consider it in our future work.

  #### ```[1]``` Ezzeldin, Y.H., Yan, S., He, C., Ferrara, E. and Avestimehr, A.S., 2023, June. Fairfed: Enabling group fairness in federated learning. In Proceedings of the AAAI Conference on Artificial Intelligence (Vol. 37, No. 6, pp. 7494-7502).

  #### ```[2]``` Lee, R., Kim, M., Li, D., Qiu, X., Hospedales, T., Huszár, F. and Lane, N.D., 2023, November. FedL2P: Federated Learning to Personalize. In Thirty-seventh Conference on Neural Information Processing Systems.

  #### ```[3]``` Fan, Z., Zhang, R., Yao, J., Han, B., Zhang, Y. and Wang, Y., 2023, November. Federated Learning with Bilateral Curation for Partially Class-Disjoint Data. In Thirty-seventh Conference on Neural Information Processing Systems.

  #### ```[4]``` An, X., Shen, L., Hu, H. and Luo, Y., 2023, November. Federated Learning with Manifold Regularization and Normalized Update Reaggregation. In Thirty-seventh Conference on Neural Information Processing Systems.

  #### ```[5]``` Han, S., Park, S., Wu, F., Kim, S., Zhu, B., Xie, X. and Cha, M., 2023. Towards Attack-tolerant Federated Learning via Critical Parameter Analysis. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 4999-5008).

  #### ```[6]``` Chen, R., Wan, Q., Prakash, P., Zhang, L., Yuan, X., Gong, Y., Fu, X. and Pan, M., 2023. Workie-Talkie: Accelerating Federated Learning by Overlapping Computing and Communications via Contrastive Regularization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 16999-17009).

  #### ```[7]``` Zhang, C., Xiaoman, Z., Sotthiwat, E., Xu, Y., Liu, P., Zhen, L. and Liu, Y., 2023. Generative Gradient Inversion via Over-Parameterized Networks in Federated Learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 5126-5135).

  #### ```[8]``` Yang, C., Zhu, M., Liu, Y. and Yuan, Y., 2023. FedPD: Federated Open Set Recognition with Parameter Disentanglement. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 4882-4891).

  #### ```[9]``` Feng, C.M., Yu, K., Liu, N., Xu, X., Khan, S. and Zuo, W., 2023. Towards Instance-adaptive Inference for Federated Learning. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 23287-23296).

  #### ```[10]``` Kim, H., Kwak, Y., Jung, M., Shin, J., Kim, Y. and Kim, C., 2023. ProtoFL: Unsupervised Federated Learning via Prototypical Distillation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (pp. 6470-6479).

Reviewer comment (Experiments):
The diversity of the evaluated benchmark datasets needs to be further augmented.

Author response:
#### In the main context, we have done our experiments on one large dataset CelebA, which is a face recognition dataset, and a small dataset MNIST, which is a handwriting digits dataset. In addition, We have done more experiments on other datasets, such as CIFAR-10 in **Appendix A.16 to A.19**, which consists of diverse classes representing airplanes, cars, birds, cats, deer, dogs, frogs, horses, ships, and trucks with 6,000 images of each class. We extend the diversity of the dataset in our answers, for example, the health dataset or other FL datasets suggested by Reviewer ```hL64``` and ```5eXT``` in **Appendix C, Figure 6 and Figure 8**. We are also planning to investigate the FL with NLP tasks because the privacy leakage issues in LLM attract the attention of the research community.

Reviewer comment (Experiments):
More advanced defense mechanisms need to be added to evaluate the effectiveness of the proposed attacks. Although the authors demonstrate the performance of the proposed attack against two common defense schemes in the appendix, the following stronger defenses still need to be considered:  

[1] Huang Y, Gupta S, Song Z, et al. Evaluating gradient inversion attacks and defenses in federated learning[J]. Advances in Neural Information Processing Systems, 2021, 34: 7232-7241.  

[2] Li J, Rakin A S, Chen X, et al. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 10194-10202.  

The main reason is that the BiDO solution considered in this article is not a defense solution tailored for FL.

Author response:
#### Thank you for your comments and suggestions. We will explain the difference between model inversion attacks, gradient inversion attacks ```[1]```, and split federated learning ```[2]```. The defense methods of gradient inversion attacks cannot be used in the model inversion attacks because of the following:
  #### - model inversion attacks do not need to reconstruct original images from the **feature maps**, but gradients attack need. Therefore, gradient inversion attacks cannot be deployed on the clients because clients cannot obtain the gradient changes from the other clients.
  #### - Based on the attack mechanism above, model inversion attacks can be Black-box settings where the attacker can launch the attack on the global models it received in FL. However, the gradient inversion attacks are White-box settings in which the gradient changes must be obtained by the attackers. 
  #### The attacks in split federated learning cannot be used in our setting because the defense methods proposed in ```[2]``` are to prevent the clients from using the activation to generate data from the model during its special training scheme as a White-box setting. However, FedInverse is to target the trained models as a Black-box setting. Therefore, the defense method presented in ```[2]``` is not suitable for our setting. We will add reviews of SFL defense methods in our discussion of defense.
  #### In our future work, we will study and investigate more about the defense methods for MI attacks in FL.

#### ```[1]``` Huang Y, Gupta S, Song Z, et al. Evaluating gradient inversion attacks and defenses in federated learning[J]. Advances in Neural Information Processing Systems, 2021, 34: 7232-7241.

#### ```[2]``` Li J, Rakin A S, Chen X, et al. Ressfl: A resistance transfer framework for defending model inversion attack in split federated learning[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022: 10194-10202.

Reviewer comment (Theory):
The use of public-data assisted generative models, particularly following prior work like GMI, KED-MI, or VMI, implicitly assumes that the client data distributions can be found in the public domain. However, in many practical FL settings, this assumption is often unwarranted. Many settings where FL is helpful—such as medical images across hospitals—are often where the data distributions aren’t covered by publicly available data.

Author response:
#### The lack of publicly available data is the current challenge for most model-inversion attackers and limits the usefulness of not only our proposed method but also most of the other public-data-assisted generative models, including GMI, KED-MI, and VMI. FedInverse uses very limited similar but different distributed public data to launch the model inversion attacks in our FL settings. This is more realistic in real-world applications because there are still available public data that have similar but not the same distribution to the targeted data from the global model. For example, the experiments in **Appendix A.2** have been conducted using FMNIST ```[1]```  and EMNIST ```[2]```  as the public datasets to generate the data from MNIST. Referring to the comments from Reviewer ```5eXT```, our work aims to evaluate the boundaries of privacy protection in the whole FL system from the client's perspective, whether the client can obtain data from other clients. From the reviewer's suggestions and comments, we can evaluate that the FL task can be considered secure if no public datasets can be leveraged by attackers. Therefore, evaluating privacy boundaries under model inversion attacks in FL is important for the FL research community.

#### Following the reviewers' suggestions, we conducted the experiments and reviewed the feasibility of our FedInverse in the health domain by using the COVID-19 CT Scan Dataset ```[3]``` to reveal Fed-LIDC-IDRI in FLamby ```[4]```. The initial results have been updated to the rebuttal revision in **Appendix C, Figure 6**, which shows the performance of FedInverse on Fed-LIDC-IDRI in FLamby ```[4]``` using the COVID-19 CT Scan Dataset ```[3]``` as the public dataset. However, our FedInverse aims to evaluate the privacy leakage issue in FL. We need to review more literature in the medical image domain so that we can understand how privacy is leaked through reversed CT Scans. We will add the detailed results and the dataset in the Appendix with the final submission.

#### ```[1]``` Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017
#### ```[2]``` Gregory Cohen, Saeed Afshar, Jonathan Tapson, and Andre Van Schaik. Emnist: Extending mnist to handwritten letters. In 2017 international joint conference on neural networks (IJCNN), pp.2921–2926. IEEE, 2017.
#### ```[3]``` Kaggle. Covid-19 ct scans. https://www.kaggle.com/datasets/andrewmvd/covid19-ct-scans/., 2019.
#### ```[4]``` FLamby: Datasets and Benchmarks for Cross-Silo Federated Learning in Realistic Healthcare Settings. NeurIPS 2022 Datasets and Benchmark. https://arxiv.org/abs/2210.04620

Reviewer comment (Experiments):
The experiments can be improved in terms of both quality and quantity.

Author response:
- #### As is recognized by the reviewer, current model inversion attacks cannot avoid using public datasets. However, in assessing the risks of privacy leakage in FL from clients, determining the privacy protection boundary remains essential and is indeed the primary contribution of our paper. In our evaluation, FedInverse can overcome this in-distribution nature caused by using public datasets. Take the experiments on MNIST by using EMNIST as a public prior dataset; for example, we use EMNIST of letter-images ("A-Z") to reverse MNIST digits-images ("0-4"). This means FedInverse can generate out-distribution images with high accuracy (see Appendix A.2.2--Table 4).

- #### In our paper, we evaluated on both large and small datasets. For example, CelebA ```[1]``` is a very large dataset that contains 10,177 identities, 202,599 face images, and 5 landmark locations, 40 binary attribute annotations per image. The dataset of CIFAR-10 ```[2]``` and MNIST ```[3]``` provides an additional evaluation of small datasets. For FedInverse evaluation on iNaturalist, we spent time on data processing and training a newly designed MI attack model for iNaturalist privacy leakage evaluation purposes. However, considering the dataset size, volume of classes, and very large images, it will take time for the new attack model design and training purposes. Therefore, we will update the results in the Appendix once the experiment on iNaturalist is done. 
  #### In regard to the concerns of the reviewer, "model-inverted examples do not look much alike the true examples." The purpose of a model inversion attack is not to generate the exact same image that humans recognize. The biometric identity (e.g. face) can be successfully reconstructed to break into otherwise secure systems even if humans do not recognize the model-inverted examples look much alike the true examples ```[4]```. Therefore, in addition to demonstrating the inverted images, the extent of generated images leaking privacy is numerically evaluated by the evaluation classifier. A high accuracy of the classification results from the evaluation classifier means the generated images contain critical biometric identities that can be used to intrude on other systems. We will add one sentence in the main context to explain the privacy leakage issue for face recognition.
  #### We also evaluated the impact of FL setup changes in our paper, including the number of clients and local batch sizes. In **Appendix A.3, A.4, A.10, A.11**, we evaluated the impact of FedInverse with different numbers of clients on both CelebA and MNIST datasets. In **Appendix A.5, A.6, A.12, A.13**, we evaluated the impact of FedInverse with different local batch sizes on both CelebA and MNIST datasets.

#### ```[1]``` Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of the IEEE international conference on computer vision, pp. 3730–3738, 2015.
#### ```[2]``` Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
#### ```[3]``` Yann LeCun, L´eon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11):2278–2324, 1998.
#### ```[4]``` Kuan-ChiehWang, Yan Fu, Ke Li, Ashish Khisti, Richard Zemel, and Alireza Makhzani. Variational model inversion attacks. Advances in Neural Information Processing Systems, 34:9706–9719, 2021

Reviewer comment (Experiments):
The evaluated datasets are fairly small; there are large federated datasets such as iNaturalist that would help make the results more convincing. By looking at Figure 4(a), the reader may argue that the model-inverted examples do not look much like the true examples; it is unclear what happens if the dataset and the FL setup is scaled up (e.g., more clients, larger local batch sizes).

Author response:
- #### In our paper, we evaluated on both large and small datasets. For example, CelebA ```[1]``` is a very large dataset that contains 10,177 identities, 202,599 face images, and 5 landmark locations, 40 binary attribute annotations per image. The dataset of CIFAR-10 ```[2]``` and MNIST ```[3]``` provides an additional evaluation of small datasets. For FedInverse evaluation on iNaturalist, we spent time on data processing and training a newly designed MI attack model for iNaturalist privacy leakage evaluation purposes. However, considering the dataset size, volume of classes, and very large images, it will take time for the new attack model design and training purposes. Therefore, we will update the results in the Appendix once the experiment on iNaturalist is done. 
  #### In regard to the concerns of the reviewer, "model-inverted examples do not look much alike the true examples." The purpose of a model inversion attack is not to generate the exact same image that humans recognize. The biometric identity (e.g. face) can be successfully reconstructed to break into otherwise secure systems even if humans do not recognize the model-inverted examples look much alike the true examples ```[4]```. Therefore, in addition to demonstrating the inverted images, the extent of generated images leaking privacy is numerically evaluated by the evaluation classifier. A high accuracy of the classification results from the evaluation classifier means the generated images contain critical biometric identities that can be used to intrude on other systems. We will add one sentence in the main context to explain the privacy leakage issue for face recognition.
  #### We also evaluated the impact of FL setup changes in our paper, including the number of clients and local batch sizes. In **Appendix A.3, A.4, A.10, A.11**, we evaluated the impact of FedInverse with different numbers of clients on both CelebA and MNIST datasets. In **Appendix A.5, A.6, A.12, A.13**, we evaluated the impact of FedInverse with different local batch sizes on both CelebA and MNIST datasets.

Reviewer comment (Reproducibility):
The bulk of the experimental results rely on having a good “evaluation classifier” which tells apart real vs generated (model-inverted) images and whose embeddings are good enough to give meaningful Frechet inception distances. However, it is unclear how such a classifier was trained.

Author response:
- ####  The evaluation classifier is well-trained by using the whole dataset with a very high testing accuracy which achieved around 98%. We will add this claim in the main context.

Reviewer comment (Evaluation):
There is a core issue of possible plausible deniability that the model-inverted images are indeed part of the training set. Just because the evaluation classifier says the generated images are realistic, can we be sure that they actually are? Is the similarity provable? Figure 4(a) does not seem to support the use of the proposed metrics.

Author response:
- #### The existing MI inversion research, including GMI ```[1]```, KED-MI ```[2]```, VMI ```[3]``` and BiDO ```[4]``` use the FID to measure the similarity between biometric identity. As we answered the questions from **Rebuttal for W2**, the biometric identity can be successfully reconstructed to break into otherwise secure systems even if humans do not recognize the model-inverted examples look much alike the true examples ```[3]```. Therefore, in addition to demonstrating the inverted images, the extent of generated images leaking privacy is numerically evaluated by the evaluation classifier. A high accuracy of the classification results from the evaluation classifier means the generated images contain critical biometric identities that can be used to intrude on other systems. We will add one sentence in the main context to explain the privacy leakage issue for face recognition.

Reviewer comment (Experiments):
I would appreciate if the authors provide more visualization results of the generated samples, e.g., on CIFAR-10, as well as across different attack success rates.

Author response:
- #### Thanks for the reviewer giving the comments. Please see the experiment results on CIFAR-10 of the generated samples across different attack success rates shown in **Appendix C, Figure 7**.