Refiner: Data Refining against Gradient Leakage Attacks in Federated Learning

TL;DR

Refiner introduces a novel data construction method that enhances privacy in federated learning by creating robust data with low semantic similarity to client data, effectively defending against gradient leakage attacks.

Contribution

This paper proposes Refiner, a new defense mechanism that constructs robust data to obfuscate gradients, outperforming existing gradient perturbation methods against sophisticated attacks.

Findings

Refiner significantly reduces attack success rates.

Maintains high model accuracy under attack.

Outperforms existing defenses on benchmark datasets.

Abstract

Recent works have brought attention to the vulnerability of Federated Learning (FL) systems to gradient leakage attacks. Such attacks exploit clients' uploaded gradients to reconstruct their sensitive data, thereby compromising the privacy protection capability of FL. In response, various defense mechanisms have been proposed to mitigate this threat by manipulating the uploaded gradients. Unfortunately, empirical evaluations have demonstrated limited resilience of these defenses against sophisticated attacks, indicating an urgent need for more effective defenses. In this paper, we explore a novel defensive paradigm that departs from conventional gradient perturbation approaches and instead focuses on the construction of robust data. Intuitively, if robust data exhibits low semantic similarity with clients' raw data, the gradients associated with robust data can effectively obfuscate attackers. To this end, we design Refiner that jointly optimizes two metrics for privacy protection and performance maintenance. The utility metric is designed to promote consistency between the gradients of key parameters associated with robust data and those derived from clients' data, thus maintaining model performance. Furthermore, the privacy metric guides the generation of robust data towards enlarging the semantic gap with clients' data. Theoretical analysis supports the effectiveness of Refiner, and empirical evaluations on multiple benchmark datasets demonstrate the superior defense effectiveness of Refiner at defending against state-of-the-art attacks.