R-CONV: An Analytical Approach for Efficient Data Reconstruction via Convolutional Gradients

TL;DR

This paper presents a novel analytical method for reconstructing training data from convolutional layer gradients in federated learning, revealing significant privacy risks even with common activation functions like ReLU.

Contribution

It introduces the first analytical approach capable of reconstructing convolutional layer inputs directly from gradients, surpassing previous methods limited to fully connected layers.

Findings

Reconstruction is possible even with ReLU activations.

Existing analytical methods underestimate attack accuracy.

Less than 5% of gradient constraints can suffice for successful attacks.

Abstract

In the effort to learn from extensive collections of distributed data, federated learning has emerged as a promising approach for preserving privacy by using a gradient-sharing mechanism instead of exchanging raw data. However, recent studies show that private training data can be leaked through many gradient attacks. While previous analytical-based attacks have successfully reconstructed input data from fully connected layers, their effectiveness diminishes when applied to convolutional layers. This paper introduces an advanced data leakage method to efficiently exploit convolutional layers' gradients. We present a surprising finding: even with non-fully invertible activation functions, such as ReLU, we can analytically reconstruct training samples from the gradients. To the best of our knowledge, this is the first analytical approach that successfully reconstructs convolutional layer inputs directly from the gradients, bypassing the need to reconstruct layers' outputs. Prior research has mainly concentrated on the weight constraints of convolution layers, overlooking the significance of gradient constraints. Our findings demonstrate that existing analytical methods used to estimate the risk of gradient attacks lack accuracy. In some layers, attacks can be launched with less than 5% of the reported constraints.