Towards Eliminating Hard Label Constraints in Gradient Inversion Attacks

Gradient inversion attacks aim to reconstruct local training data from intermediate gradients exposed in the federated learning framework. Despite successful attacks, all previous methods, starting from reconstructing a single data point and then relaxing the single-image limit to batch level, are only tested under hard label constraints. Even for single-image reconstruction, we still lack an analysis-based algorithm to recover augmented soft labels. In this work, we change the focus from enlarging batchsize to investigating the hard label constraints, considering a …

aim attacks batch constraints cs.cr cs.cv cs.lg data exposed federated federated learning framework hard image limit local point single training training data under