A Survey on Gradient Inversion: Attacks, Defenses and Future Directions

TL;DR

This survey comprehensively reviews Gradient Inversion attacks, defenses, and future research directions, categorizing attack methods and defense strategies to guide ongoing and future work in safeguarding training data privacy.

Contribution

It provides a detailed taxonomy of GradInv attacks, analyzes key components, summarizes defense strategies, and discusses future research directions.

Findings

Attacks are categorized into iteration- and recursion-based paradigms.

Defense strategies focus on data obscuration, model enhancement, and gradient protection.

The survey highlights open problems and promising research directions.

Abstract

Recent studies have shown that the training samples can be recovered from gradients, which are called Gradient Inversion (GradInv) attacks. However, there remains a lack of extensive surveys covering recent advances and thorough analysis of this issue. In this paper, we present a comprehensive survey on GradInv, aiming to summarize the cutting-edge research and broaden the horizons for different domains. Firstly, we propose a taxonomy of GradInv attacks by characterizing existing attacks into two paradigms: iteration- and recursion-based attacks. In particular, we dig out some critical ingredients from the iteration-based attacks, including data initialization, model training and gradient matching. Second, we summarize emerging defense strategies against GradInv attacks. We find these approaches focus on three perspectives covering data obscuration, model improvement and gradient protection. Finally, we discuss some promising directions and open problems for further research.