# Approximate and Weighted Data Reconstruction Attack in Federated Learning

Yongcun Song, Ziqi Wang, and Enrique Zuazua  Y.C. Song and Z.W. Wang
(corresponding author) are with the Chair for Dynamics, Control, Machine
Learning and Numerics – Alexander von Humboldt Professorship, Department of
Mathematics, Friedrich-Alexander-Universität Erlangen-Nürnberg, Cauerstrasse
11, 91058 Erlangen, Germany. Email<EMAIL_ADDRESS><EMAIL_ADDRESS>E.
Zuazua is with the Chair for Dynamics, Control, Machine Learning and Numerics
– Alexander von Humboldt Professorship, Department of Mathematics, Friedrich-
Alexander-Universität Erlangen-Nürnberg, Cauerstrasse 11, 91058 Erlangen,
Germany; the Chair of Computational Mathematics, Fundación Deusto Avda. de las
Universidades 24, 48007 Bilbao, Basque Country, Spain; and also with the
Departamento de Matemáticas, Universidad Autónoma de Madrid, 28049 Madrid,
Spain. Email<EMAIL_ADDRESS>
###### Abstract

Federated learning (FL) is a distributed learning paradigm that enables
multiple clients to collaborate on building a machine learning model without
sharing their private data. Although FL is considered privacy-preserved by
design, recent data reconstruction attacks demonstrate that an attacker can
recover clients’ training data based on the parameters shared in FL. However,
existing methods commonly fail to attack the most widely used federated
averaging (FedAvg) scenario, where clients share model parameters after
multiple local training steps. To tackle this issue, we propose an
interpolation-based approximation method, which makes attacking FedAvg
scenarios feasible by generating the intermediate model updates of the
clients’ local training processes. Then, we design a layer-wise weighted loss
function to improve the quality of data reconstructions. We assign different
weights to model updates in different layers based on the neural network
architecture, with the weights tuned by Bayesian optimization. Finally,
experimental results validate the superiority of our proposed approximate and
weighted attack method over the other state-of-the-art methods, as
demonstrated by the substantial improvement in different evaluation metrics
for image data reconstructions.

###### Index Terms:

Data reconstruction attack, federated learning, Bayesian optimization,
gradient inversion

##  1 Introduction

With the growing amount of data generated by distributed personal electronic
devices, conventional centralized approaches for training machine learning
models face challenges in data collection and privacy protection. To address
these challenges, federated learning (FL) [1, 2] has gained significant
attention in recent years as a promising paradigm.

One prominent feature of FL is its ability to facilitate model training on
distributed data sources owned by individual clients while keeping the data
localized and exchanging only model updates. For example, in the most commonly
used federated averaging (FedAvg) [2] algorithm, each client trains its local
model with its private data and shares the updated model parameters to a
server, where the model parameters are aggregated and used to update the
global model. In other words, FL enables multiple participants to build a
common and robust machine learning model without sharing data, thus addressing
critical issues such as data privacy, data security, and data access rights.
As a result, FL has gained significant attention in recent years to handle the
growing amount of data and the increasing concerns about privacy in several
applications, such as healthcare [3, 4], and learning a controller model
across several autonomous vehicles without sharing their history trajectories
[5].

Although it was widely believed that model updates in FL are safe to share,
recent studies [6, 7, 8, 9] have shown that clients’ sensitive training data
can be compromised through _data reconstruction attacks_ [9]. In these
attacks, the adversary first randomly initializes dummy samples and labels,
and then executes forward and backward propagation to obtain dummy model
updates. Through an iterative process of minimizing the discrepancy between
the dummy model updates and the ground-truth ones, the dummy samples and
labels are updated simultaneously. In the literature, some work has already
been done to improve the reconstruction performance, we refer to the label
inference techniques in [8, 10], the new distance functions and optimizers in
[11, 12], and the regularization methods in [13, 14].

By inferring labels in advance, the joint optimization of both samples and
labels can be avoided, thus reducing the complexity of the optimization
problem. It was first discovered in [10] that the label information of a
single sample can be analytically extracted based on the model updates of the
last fully connected layer. Later, [8] extended the single sample label
extraction to batch samples, under the limiting assumption of non-repeating
labels in the batch. The above limitation is further addressed by the batch
label inference approach proposed in [6].

To measure the discrepancy between the dummy and ground-truth model updates,
the Euclidean distance is commonly used in the loss function for the attack,
see [8, 10, 9]. Moreover, the angle-based cosine similarity was suggested in
[11, 7] since the high-dimensional direction of the model updates carries more
information than the magnitude. In [12], a Gaussian kernel of model updates
differences was proposed to measure the discrepancy, allowing the scaling
factor in the kernel to be adapted to the distribution of model updates in
each attack.

As for the optimizers employed in the attacks, the L-BFGS [15] and the Adam
[16] are the most commonly used ones, see e.g., [11, 13, 12, 14, 8, 10, 9]. In
particular, the reconstruction performance of the above two optimizers was
compared in [11, 12, 14]. It has been shown in [14] that the L-BFGS requires
fewer attack iterations to achieve high reconstruction quality compared to the
Adam when attacking the LFW dataset [17]. On the other hand, in [11], the
L-BFGS performs worse than the Adam for the CIFAR-10 dataset [18]. Although
there is no definitive analysis guiding the selection of cost functions and
optimizers, it is evident that appropriate choices can enhance the
effectiveness of attacks in specific scenarios.

Another important way to improve the reconstruction performance is to add
auxiliary regularization terms to the loss function for the attack based on
some prior knowledge of the data. In [14], a label regularizer was proposed to
match the dummy samples and labels when both of them are optimized
simultaneously. Moreover, some image prior information can be employed for
image reconstruction attacks, such as the total variation regularization [11]
to reduce the noise in images, and the group registration regularization [8]
to center the position of the main object in images. In [8], a prior term is
proposed based on the mean and variance of a mini-batch used at the batch
normalization layers. A generative model pre-trained on the raw data
distribution was used in [13] to improve the reconstruction. However, in
normal distributed learning systems, batch normalization information and raw
data distribution are not necessarily shared, which makes these methods less
practical.

Despite remarkable progress, limited attention has been paid to attacking the
FedAvg with multiple-step model updates, where clients share local model
parameters after training for multiple epochs, each executed over multiple
mini-batches. In this context, an approximate method named AGIC is proposed in
[7]. The AGIC method first initializes a combined dummy batch whose size is
the sum of all mini-batches used in the client’s local training process. This
combined dummy batch is then used to perform a single-step gradient descent
and the computed dummy model update is used to approximate the ground-truth
multi-step model update. Meanwhile, it employs a weighted cosine similarity
loss function for the attack by assigning linearly increasing weights to
different convolutional and fully connected layers. However, such an
approximation method works only for scenarios with small local learning rates
and the layer weights are chosen empirically rather than systematically.

To address the above issues, we propose a novel approximate and weighted
attack (AWA) method in data reconstruction against FL systems utilizing the
FedAvg algorithm. First, we present an interpolation-based approximation
method that generates intermediate model updates of clients’ local training
processes. As a result, attacking against the FedAvg with multiple-step model
updates becomes feasible. Then, we propose a layer-wise weighted loss function
to enhance the reconstruction quality. Different weights are assigned to model
updates at each layer based on the neural network architecture. The selection
of the weights is optimized using the Bayesian optimization method [19].

Overall, our main contributions are as follows:

  1. 1.

To attack the FedAvg using multiple-step model updates, we propose an
interpolation-based approximation method. The model update corresponding to
each epoch is approximated by interpolating the received multiple-step model
updates. The proposed approximation method makes attacks against FedAvg
scenarios feasible and effective, as demonstrated by numerical experiments.

  2. 2.

To further improve the attack performance after approximation, we employ a
layer-wise weighted loss function for the attack. Different weights are
assigned to different layers, and these weights are determined by Bayesian
optimization. Additionally, we enhance the weights of layers with large
errors, improving the attack’s adaptability and performance.

  3. 3.

Our method demonstrates environment generality by being compatible with
various neural network architectures, such as Convolutional Neural Networks
(CNNs) and Residual Neural Networks (ResNets). Furthermore, it is capable of
reconstructing training data based on the model updates leaked at different
stages of the training process.

The rest of the paper is organized as follows. In Section 2, we provide a
comprehensive background on FL and data reconstruction attacks. In Section 3,
various attack scenarios are analyzed. Section 4 presents our proposed AWA
method, including the approximation method and the layer-wise weighted loss
function. The experimental setup and simulation results are presented in
Section 5. Finally, we conclude the paper in Section 6.

##  2 Preliminaries

In this section, we first provide a detailed description of the mathematical
formulation and training process of FL. Then, we introduce the formulation and
setup of data reconstruction attacks.

###  2.1 Problem Statement of FL

FL aims to learn a model
$h:\mathbb{R}^{d_{x}}\times\mathbb{R}^{d_{\theta}}\rightarrow\mathbb{R}^{d_{y}}$
parameterized by $\theta\in\mathbb{R}^{d_{\theta}}$ such that, given any data
$x\in\mathbb{R}^{d_{x}}$, the value $h(x;\theta)$ offers an accurate
prediction about the label $y\in\mathbb{R}^{d_{y}}$. A crucial constraint in
FL is that the training data and labels are stored across $C$ distributed
clients, and each client’s data and labels can only be accessed and processed
locally during the training process.

Mathematically, the training process of FL can be formulated as the following
minimization problem [1]:

$\min_{\theta}\sum_{k=1}^{C}p_{k}F_{k}(\theta),$ (1)

where $F_{k}:\mathbb{R}^{d_{\theta}}\rightarrow\mathbb{R}$ represents the
local loss function for client $k$, and $p_{k}\geq 0$ with
$\sum_{k=1}^{C}p_{k}=1$ specifies the relative impact of client $k$. In
practice, $F_{k}$ is typically defined as the empirical risk over client $k$’s
local dataset $\\{(x^{(k)}_{i},y^{(k)}_{i})\\}_{i=1}^{N^{(k)}}$ of size
$N^{(k)}$, i.e., $F_{k}(\theta)=$
$1/{N^{(k)}}\sum_{i=1}^{N^{(k)}}\ell(h(x^{(k)}_{i};\theta),y^{(k)}_{i})$,
where $\ell$:
$\mathbb{R}^{d_{y}}\times\mathbb{R}^{d_{y}}\rightarrow\mathbb{R}$ is a
prescribed loss function. Common choices of $\ell$ include the $\ell_{2}$ and
the cross-entropy loss function, see [20] for more options. The relative
impact $p_{k}$ is often chosen as $p_{k}=N^{(k)}/N_{C}$, where
$N_{C}=\sum_{k=1}^{C}N^{(k)}$ is the total size of all the clients’ datasets.

###  2.2 FedAvg Algorithm

For solving (1), FL algorithms normally combine local model update processes
performed by each client with model aggregation steps performed by a central
server. To fix ideas, we focus on the FedAvg [2], which is the most commonly
used algorithm in FL. The FedAvg presented in Algorithm 1 involves a series of
training rounds, in which the server first dispatches the latest global model
parameters to a subset of clients. Then, the selected clients compute model
updates to the current global model with their private data and send the
updated model parameters back to the server. Finally, the server aggregates
the received model parameters to update the global model parameters, which
serve as the initializer for the next training round.

Algorithm 1 Federated Averaging.

1: Server initializes the global model parameters $\theta_{1}$.

2: for each training round $t=1,2,\ldots,T$ do

3: Server selects a subset $\mathcal{K}\subseteq\\{k\\}_{k=1}^{C}$ of clients
and sends them $\theta_{t}$.

4: for each client $k\in\mathcal{K}$ in parallel do

5: $\theta_{t+1}^{(k)}\leftarrow\textbf{ClientUpdate}(k,t,\theta_{t})$.

6: end for

7: $N_{K}=\sum_{k\in\mathcal{K}}N^{(k)}$,

8:
$\theta_{t+1}=\sum_{k\in\mathcal{K}}\frac{N^{(k)}}{N_{K}}\theta_{t+1}^{(k)}$.

9: end for

1: $\textbf{ClientUpdate}(k,t,\theta_{t}):$

2: Client $k$ sets its local model parameters
$\theta_{t,1,1}^{(k)}:=\theta_{t}$.

3: for each epoch $e=1,2,\ldots,E$ do

4: Randomly split dataset
$\mathcal{D}^{(k)}=\\{(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)})\\}_{b=1}^{B^{(k)}}$.

5: for each mini-batch $b=1,2,\ldots,B^{(k)}$ do

6:
$\theta_{t,e,b}^{(k)}:=\theta_{t,e,b}^{(k)}-\eta\nabla_{\theta_{t,e,b}^{(k)}}\ell(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)})$.

7: end for

8: end for

9: Set $\theta_{t+1}^{(k)}:=\theta_{t,e,b}^{(k)}$.

10: return $\theta_{t+1}^{(k)}$ back to the server.

Next, we elaborate on the implementation of Algorithm 1. At each round
$t=1,2,\ldots,T$, the server selects a set of clients
$\mathcal{K}\subseteq\\{k\\}_{k=1}^{C}$ to participate in the training and
sends them the current global model parameters $\theta_{t}$. Then, each
selected client $k\in\mathcal{K}$ sets its local model parameters
$\theta_{t}^{(k)}=\theta_{t}$ and updates $\theta_{t}^{(k)}$ for $E$ epochs,
each consisting of $B^{(k)}$ mini-batches.

In each epoch $e=1,2,\ldots,E$, client $k$ first shuffles its dataset
$\mathcal{D}^{(k)}$ and partitions it into $B^{(k)}=N^{(k)}/M$ mini-batches
(without loss of generality, we assume that the dataset is divisible into
$B^{(k)}$ mini-batches of size $M$):

$\mathcal{D}^{(k)}=\\{(X^{(k)},Y^{(k)})\\}=\\{(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)})\\}_{b=1}^{B^{(k)}},$
(2)

where $X^{(k)}=\\{x^{(k)}_{i}\\}_{i=1}^{N^{(k)}}$ is the set of the training
data, $Y^{(k)}=\\{y^{(k)}_{i}\\}_{i=1}^{N^{(k)}}$ is the set of the labels,
and $\\{(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)})\\}$ represents the $b$-th mini-batch
at round $t$, epoch $e$. If not otherwise stated, the subscripts $t$, $e$, and
$b$ in the following discussions indicate the index of the round, the epoch,
and the mini-batch, respectively.

For each mini-batch $b=1,2,\ldots,B^{(k)}$, client $k$ updates its local model
parameters $\theta_{t,e,b}^{(k)}:=\theta_{t}^{(k)}$ using the mini-batch
gradient descent:

$\theta_{t,e,b}^{(k)}:=\theta_{t,e,b}^{(k)}-\eta\nabla_{\theta_{t,e,b}^{(k)}}\ell\left(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)}\right),$
(3)

where $\eta>0$ is the learning rate (step size), and we use
$\ell(X,Y):=1/M\sum_{i=1}^{M}\ell(h(x_{i};\theta),y_{i})$ to represent the
average loss of a mini-batch $\\{(X,Y)\\}:=\\{(x_{i},y_{i})\\}_{i=1}^{M}$ of
size $M$ for simplicity.

After training for $E$ epochs (each epoch consists of $B^{(k)}$ mini-batches),
client $k$’s model update $\Delta\theta_{t}^{(k)}$ can be obtained as

$\Delta\theta_{t}^{(k)}=-\eta\sum_{e=1}^{E}\sum_{b=1}^{B^{(k)}}\nabla_{\theta_{t,e,b}^{(k)}}\ell\left(X_{t,e,b}^{(k)},Y_{t,e,b}^{(k)}\right).$
(4)

As a result, client $k$’s local model parameters $\theta_{t+1}^{(k)}$ become

$\theta_{t+1}^{(k)}=\theta_{t}^{(k)}+\Delta\theta_{t}^{(k)}.$ (5)

Then, client $k$ sends its updated local model parameter $\theta_{t+1}^{(k)}$
back to the server for averaging.

After receiving updated local model parameters
$\\{\theta_{t+1}^{(k)}\\}_{k\in\mathcal{K}}$ from the clients, the server
performs the weighted model parameters averaging as follows:

$\theta_{t+1}=\sum_{k\in\mathcal{K}}\frac{N^{(k)}}{N_{K}}\theta_{t+1}^{(k)},$
(6)

where $N_{K}=\sum_{k\in\mathcal{K}}N^{(k)}$ is the total size of $K$
participated clients’ datasets. Finally, the aggregated global model
parameters $\theta_{t+1}$ are used as the initializer for the next round.

###  2.3 Data Reconstruction Attack

Despite the fact that the clients only share the updated model parameters with
the server, their private training data are still vulnerable to data
reconstruction attacks [11, 8, 9]. In this subsection, we introduce the
formulation and the general procedure of a data reconstruction attack.

As shown in (4), during the local training process at round $t$, client $k$’s
model update $\Delta\theta_{t}^{(k)}$ consists of the gradients computed over
$E\times B^{(k)}$ mini-batches. Let $G_{t}^{(k)}$ be a mapping from the
training data $\\{(X^{(k)},Y^{(k)})\\}$ defined in (2) to the model update
$\Delta\theta_{t}^{(k)}$, then we can rewrite (4) in a compact manner as

$\Delta\theta_{t}^{(k)}=G_{t}^{(k)}\left(X^{(k)},Y^{(k)}\right).$ (7)

For an attacker with access to $\Delta\theta_{t}^{(k)}$, reconstructing
$\\{(X^{(k)},Y^{(k)})\\}$ is essentially an inverse problem. In particular, if
$[G_{t}^{(k)}]^{-1}$ exists and is known analytically, the attacker can
recover $\\{(X^{(k)},Y^{(k)})\\}$ directly as follows:

$\left(X^{(k)},Y^{(k)}\right)=[G_{t}^{(k)}]^{-1}\left(\Delta\theta_{t}^{(k)}\right).$
(8)

However, since neural networks are highly nonlinear and the model updates are
aggregated over multiple mini-batches, it is generally difficult to identify
$[G_{t}^{(k)}]^{-1}$. To address this issue, we introduce a numerical approach
for solving (7).

Notice from (8) that the attacker can independently attack any client
$k\in\mathcal{K}$ that participated in the training at round $t$. Therefore,
in the sequel we omit the superscript $k$ to simplify the notation.

Assuming an attacker can get access to the client’s training process and hence
knows $G_{t}$, then problem (7) can be solved by the numerical approach
elaborated below. First, to launch the attack, the attacker randomly
initializes a dummy dataset $(\hat{X},\hat{Y})$ with the same dimension as
that of the client’s ground-truth dataset $(X,Y)$. The attacker uses $G_{t}$
to calculate the dummy model update $\Delta\hat{\theta}_{t}$ given by

$\Delta\hat{\theta}_{t}=G_{t}(\hat{X},\hat{Y}).$ (9)

Proceeding as in [9], the attacker can reconstruct the client’s dataset by
matching the dummy model update $\Delta\hat{\theta}_{t}$ with the ground-truth
model update $\Delta\theta_{t}$, minimizing a model update matching loss
function $\ell_{m}$, for instance, of the type

$\ell_{m}(\hat{X},\hat{Y})=\|\Delta\hat{\theta}_{t}-\Delta\theta_{t}\|^{2}.$
(10)

In practice, one can also use other loss functions like the cosine similarity
loss [11] to evaluate the distance between $\Delta\hat{\theta}_{t}$ and
$\Delta\theta_{t}$. Finally, the reconstructed data
$(\hat{X}^{*},\hat{Y}^{*})$ can be obtained by solving the following
optimization problem:

$(\hat{X}^{*},\hat{Y}^{*})=\arg\min_{\hat{X},\hat{Y}}\ell_{m}(\hat{X},\hat{Y}).$
(11)

This can be done using the gradient descent method with a learning rate
$\hat{\eta}$:

$\hat{X}:=\hat{X}-\hat{\eta}\nabla_{\hat{X}}\ell_{m}(\hat{X},\hat{Y}),\quad\hat{Y}:=\hat{Y}-\hat{\eta}\nabla_{\hat{Y}}\ell_{m}(\hat{X},\hat{Y}).$

######  Remark 2.1.

In FL, the central server holds substantial information about the training
process. Data reconstruction attacks can typically be developed by an honest-
but-curious server [11], acting as an attacker, who has access to the
following information, and in particular $G_{t}$ in (9).

  1. 1.

Model architecture of $h$: Normally the server decides the architecture of the
neural network that is shared among all the clients.

  2. 2.

Initial model parameters $\theta_{t}$: For each client, its initial local
model parameter $\theta_{t}$ is dispatched from the server.

  3. 3.

Model update $\Delta\theta_{t}$: Each client sends the updated model
parameters $\theta_{t+1}$ obtained in (5) back to the server. Thus,
$\Delta\theta_{t}=\theta_{t+1}-\theta_{t}$ can be obtained by the server
easily.

  4. 4.

Loss function $\ell$: Similar to $h$, it is common for the server to know the
form of the loss function that is shared among all the clients. The choice
made is kept unchanged during the training process.

  5. 5.

Dataset size $N$: This information is shared with the server for weighted
aggregation as shown in (6).

  6. 6.

Client’s local training hyperparameters: As shown in (4) and (7), the
knowledge of $G_{t}$ depends on the hyperparameters listed below. In general
cases, the server can assign these hyperparameters to each client:

    1. (a)

Number of epochs $E$;

    2. (b)

Number of mini-batches $B$;

    3. (c)

Learning rate $\eta$.

##  3 Analysis of Attack Scenarios: Different $E$ and $B$

As shown in (9), a data reconstruction attack requires the knowledge of
$G_{t}$ to calculate the dummy model update $\Delta\hat{\theta}_{t}$. In this
section, we discuss the difficulty of knowing $G_{t}$ for four FedAvg
scenarios in terms of different values of $E$ and $B$, especially when $E>1$
and $B>1$.

Scenario 1: $E=1,B=1$. As we shall see, the attacker can get access to $G_{t}$
and replicate the client’s training process. Indeed, since $E=1$ and $B=1$,
the client uses the full-batch gradient descent for one epoch as follows:

$\displaystyle G_{t}(X,Y)$
$\displaystyle=-\eta\nabla_{\theta_{t}}\ell\left(X,Y\right)$ (12)
$\displaystyle=-\eta\frac{1}{N}\sum_{i=1}^{N}\nabla_{\theta_{t}}\ell\left(x_{i},y_{i}\right).$

Thus, the attacker can replicate the client’s training process by replacing
$(X,Y)$ with the dummy dataset
$(\hat{X},\hat{Y})=\\{(\hat{x}_{i},\hat{y}_{i})\\}_{i=1}^{N}$ in the following
way:

$\displaystyle G_{t}(\hat{X},\hat{Y})$
$\displaystyle=-\eta\nabla_{\theta_{t}}\ell\left(\hat{X},\hat{Y}\right)$ (13)
$\displaystyle=-\eta\frac{1}{N}\sum_{i=1}^{N}\nabla_{\theta_{t}}\ell\left(\hat{x}_{i},\hat{y}_{i}\right).$

Scenario 2: $E>1,B=1$. The attacker can also obtain the knowledge of $G_{t}$
in this scenario. To be concrete, the client uses the full-batch gradient
descent for $E$ epochs:

$G_{t}(X,Y)=-\eta\sum_{e=1}^{E}\nabla_{\theta_{t,e}}\ell\left(X,Y\right).$
(14)

In each epoch, since $B=1$, the gradients are computed on the $N$ samples, as
in Scenario 1. In this case, the attacker can replicate the client’s training
process by replacing $(X,Y)$ with the dummy dataset $(\hat{X},\hat{Y})$, and
train the model for $E$ epochs as follows:

$G_{t}(\hat{X},\hat{Y})=-\eta\sum_{e=1}^{E}\nabla_{\theta_{t,e}}\ell\left(\hat{X},\hat{Y}\right).$
(15)

Scenario 3: $E=1,B>1$. In this scenario, since $B>1$, the client uses the
mini-batch gradient descent for one epoch in the following way:

$G_{t}(X,Y)=-\eta\sum_{b=1}^{B}\nabla_{\theta_{t,b}}\ell\left(X_{t,b},Y_{t,b}\right).$
(16)

When using the mini-batch gradient descent, at the beginning of each epoch,
the client randomly shuffles the dataset and separates it into $B$ mini-
batches. In this scenario, since $E=1$, the dataset is only shuffled once.

The attacker can first separate its dummy dataset $(\hat{X},\hat{Y})$ into $B$
mini-batches $\\{(\hat{X}_{t,b},\hat{Y}_{t,b})\\}_{b=1}^{B}$. Then, by
replacing $(X_{t,b},Y_{t,b})$ in (16) with $(\hat{X}_{t,b},\hat{Y}_{t,b})$, it
can replicate the client’s training process as below:

$G_{t}(\hat{X},\hat{Y})=-\eta\sum_{b=1}^{B}\nabla_{\theta_{t,b}}\ell\left(\hat{X}_{t,b},\hat{Y}_{t,b}\right).$
(17)

The only difference is that the reconstructed $(\hat{X},\hat{Y})$ are in the
same order as that of the shuffled client’s dataset. Hence, the attacker can
still obtain $G_{t}$ and replicate the local training process in this
scenario.

Scenario 4: $E>1,B>1$. In this case, the attacker cannot gain the needed
knowledge of $G_{t}$ to calculate the dummy model update
$\Delta\hat{\theta}_{t}$ defined in (9).

Indeed, the client uses the mini-batch gradient descent for $E$ epochs:

$G_{t}(X,Y)=-\eta\sum_{e=1}^{E}\sum_{b=1}^{B}\nabla_{\theta_{t,e,b}}\ell\left(X_{t,e,b},Y_{t,e,b}\right).$
(18)

In each epoch, the client first shuffles its dataset and then separates it
into $B$ mini-batches. As a result, the attacker cannot replicate the client’s
mini-batch separation when $E>1$ due to the randomness of the shuffling
process.

The existing attack methods are normally applicable to Scenarios 1-3 and
limited attention has been given to the more challenging Scenario 4. To
address it, we propose an interpolation-based approximation method. By
interpolating the intercepted model updates, the attacker can approximate the
intermediate model updates corresponding to each epoch, thereby reducing the
problem from Scenario 4 to Scenario 3. The details of the proposed method are
presented in Section 4.1.

##  4 Approximate and Weighted Attack in Data Reconstruction

In this section, we propose an approximate and weighted data reconstruction
attack method for solving (7).

###  4.1 Approximation of the Intermediate Model Updates

As discussed in Section 3, when $E>1$ and $B>1$, the shuffle of the dataset in
each epoch makes it difficult for the attacker to know $G_{t}$. However, if
the attacker knows the intermediate model update $\Delta\theta_{t,e}$ of any
epoch $e\in\\{1,2,\ldots,E\\}$, the problem can be reduced from Scenario 4
($E>1$ and $B>1$) to Scenario 3 ($E=1$ and $B>1$) by attacking each epoch
separately.

To this end, we interpolate between $\theta_{t+1}$ and $\theta_{t}$ to
approximate the intermediate model parameters $\\{\theta_{t,e}\\}_{e=1}^{E}$
corresponding to each epoch. Particularly, consider a client who trains its
model for $E$ epochs, the approximate intermediate model parameters
$\\{\tilde{\theta}_{t,e}\\}_{e=1}^{E}$ can be obtained as

$\tilde{\theta}_{t,e}=\frac{\theta_{t+1}-\theta_{t}}{E}e+\theta_{t},\quad
e=1,2,\ldots,E.$ (19)

Then, the approximate model updates
$\\{\Delta\tilde{\theta}_{t,e}\\}_{e=1}^{E}$ corresponding to each epoch can
be obtained as

$\Delta\tilde{\theta}_{t,e}=\tilde{\theta}_{t,e}-\tilde{\theta}_{t,e-1},\quad
e=1,2,\ldots,E,$ (20)

where $\tilde{\theta}_{t,0}=\theta_{t}$ is the initial model parameter at
round $t$.

After obtaining the approximate $\\{\Delta\tilde{\theta}_{t,e}\\}_{e=1}^{E}$,
the attacker can use it to represent the unknown intermediate model update
$\Delta\theta_{t,e}$ for any epoch $e\in\\{1,2,\ldots,E\\}$. In other words,
the attack problem is reduced from Scenario 4 ($E>1$ and $B>1$) to Scenario 3
($E=1$ and $B>1$).

We denote by $G_{t,e}$ the client’s training process at round $t$, epoch $e$.
Then, the dummy model update $\Delta\hat{\theta}_{t,e}$ can be obtained based
on (17), given as

$\Delta\hat{\theta}_{t,e}=G_{t,e}(\hat{X},\hat{Y})=-\eta\sum_{b=1}^{B}\nabla_{\theta_{t,e,b}}\ell\left(\hat{X}_{t,e,b},\hat{Y}_{t,e,b}\right).$
(21)

Finally, the attack can be conducted following the procedures of Scenario 3.

###  4.2 Improved Weighted Loss Function for the Data Reconstruction Attack

The commonly used loss function (10) for the data reconstruction attack treats
different components of the model update $\Delta\theta_{t}$ equally. However,
as observed in [21], different layers in a neural network provide different
contributions to boosting the performance. Inspired by this fact, we propose
to assign different weights to the model updates at different layers to
facilitate the reconstruction. The implementation of our method is elaborated
below

Consider a neural network with $L$ layers. Then the model update
$\Delta\theta_{t}$ consists of superposition of the updates
$\Delta\theta_{t}^{(l)}$ of each layer:

$\Delta\theta_{t}=\\{\Delta\theta_{t}^{(l)}\\}_{l=1}^{L}.$ (22)

The same applies to the dummy model updates
$\Delta\hat{\theta_{t}}=\\{\Delta\hat{\theta}_{t}^{(l)}\\}_{l=1}^{L}$. Then,
by assigning the weight $q^{(l)}>0$ to the model updates at layer $l$, the
loss function (10) for the attack becomes

$\ell_{Q}(\hat{X},\hat{Y})=\sum_{l=1}^{L}q^{(l)}\left\|\Delta\hat{\theta}_{t}^{(l)}-\Delta\theta_{t}^{(l)}\right\|^{2}.$
(23)

The weighted loss function (23) leverages the distinct characteristics of
different layers in the model update. In the next subsection, we introduce a
systematic method to design the layer weights $q^{(l)}$ to enhance the
reconstruction performance.

####  4.2.1 Design of Layer Weights

Increasing weights layer by layer. We consider linearly increasing weight
functions for different types of layers. To expose our ideas clearly, we focus
on the commonly used ResNet architecture [22], which contains convolutional,
batch normalization, and fully connected layers. Specifically, we design the
following weight functions for each kind of layer:

$\displaystyle\begin{split}q_{cv}^{(l)}&=\begin{cases}\frac{q_{cv}-1}{L_{cv}-1}(l-1)+1,&\text{if
}l=1,2,...,L_{cv}>1,\\\ q_{cv},&\text{if }l=L_{cv}=1,\end{cases}\end{split}$
(24a)
$\displaystyle\begin{split}q_{bn}^{(l)}&=\begin{cases}\frac{q_{bn}-1}{L_{bn}-1}(l-1)+1,&\text{if
}l=1,2,...,L_{bn}>1,\\\ q_{bn},&\text{if }l=L_{bn}=1,\end{cases}\end{split}$
(24b)
$\displaystyle\begin{split}q_{fc}^{(l)}&=\begin{cases}\frac{q_{fc}-1}{L_{fc}-1}(l-1)+1,&\text{if
}l=1,2,...,L_{fc}>1,\\\ q_{fc},&\text{if }l=L_{fc}=1,\end{cases}\end{split}$
(24c)

where $L_{cv}$, $L_{bn}$, and $L_{fc}$ are the numbers of the convolutional,
batch normalization, and fully connected layers, respectively, and
$L=L_{cv}+L_{bn}+L_{fc}$. The values $q_{cv}>1$, $q_{bn}>1$, and $q_{fc}>1$
are the largest weights assigned to the last layer of each respective kind.
For a given neural network with a fixed number of layers ($L_{cv}$, $L_{bn}$
and $L_{fc}$), the values of $q_{cv}$, $q_{bn}$ and $q_{fc}$ determine the
slope of the linearly increasing weight functions in (24).

Enhancing the weights of layers with larger errors. Adding linearly increasing
weights determined by (24) to the loss function (23) may overly emphasize the
importance of some layers in the neural network and lead to a biased
reconstruction. To strike a balance between adding linearly increasing weights
and avoiding biased reconstructions, we propose to modify the weights of
layers with larger errors by exploiting the statistical information including
the mean $\mu(\cdot)$ and the variance $\sigma^{2}(\cdot)$ of the layer-wise
model updates $\\{\Delta\theta_{t}^{(l)}\\}_{l=1}^{L}$ in (22). The procedure
of our enhancing method is elaborated below.

First, we calculate the relative error $e_{mean}^{(l)}$ and $e_{var}^{(l)}$ of
the dummy model update $\Delta\hat{\theta}_{t}^{(l)}$ and the ground-truth
model update $\Delta\theta_{t}^{(l)}$ at each layer as follows:

$e_{mean}^{(l)}=\frac{|\mu(\Delta\hat{\theta}_{t}^{(l)})-\mu(\Delta\theta_{t}^{(l)})|}{|\mu(\Delta\theta_{t}^{(l)})|},\quad
l=1,2,...,L,$ (25)
$e_{var}^{(l)}=\frac{|\sigma^{2}(\Delta\hat{\theta}_{t}^{(l)})-\sigma^{2}(\Delta\theta_{t}^{(l)})|}{|\sigma^{2}(\Delta\theta_{t}^{(l)})|},\quad
l=1,2,...,L.$ (26)

Next, we select a subset $\mathcal{P}\subseteq\mathcal{L}=\\{l\\}_{l=1}^{L}$
of layers with the largest relative errors in terms of
$\\{e_{mean}^{(l)}\\}_{l=1}^{L}$ and $\\{e_{var}^{(l)}\\}_{l=1}^{L}$, and set
their layer weights $q^{(l)}$ to $q_{en}\in\mathbb{R}$, i.e.,

$q^{(l)}=q_{en},\quad l\in\mathcal{P}.$ (27)

The choice of the subset $\mathcal{P}$ can be decided by the proportional
parameters $p_{mean}\in[0,1]$ and $p_{var}\in[0,1]$ in the following way: For
a given $p_{mean}$, we first select $N_{mean}=\lceil p_{mean}\cdot L\rceil$
layers with the largest relative error in terms of
$\\{e_{mean}^{(l)}\\}_{l=1}^{L}$. Let the set of indices corresponding to the
$N_{mean}$ layers be denoted as $\mathcal{P}_{mean}$, that is

$\mathcal{P}_{mean}=\\{i_{1},i_{2},\ldots,i_{N_{mean}}\\},$ (28)

where $i_{1},i_{2},\ldots,i_{N_{mean}}\in\\{1,2,\ldots,L\\}$ are the indices
selected such that $e_{mean}^{(i_{1})}\geq e_{mean}^{(i_{2})}\geq\ldots\geq
e_{mean}^{(i_{N_{mean}})}\geq
e_{mean}^{(l)},l\in\mathcal{L}\setminus\mathcal{P}_{mean}$.

Similarly, we can get a set $\mathcal{P}_{var}$ with $N_{var}=\lceil
p_{var}\cdot L\rceil$ elements as

$\mathcal{P}_{var}=\\{j_{1},j_{2},\ldots,j_{N_{var}}\\},$ (29)

where $j_{1},j_{2},\ldots,j_{N_{var}}\in\\{1,2,\ldots,L\\}$ are the indices
that satisfy $e_{var}^{(j_{1})}\geq e_{var}^{(j_{2})}\geq\ldots\geq
e_{var}^{(j_{N_{var}})}\geq
e_{var}^{(l)},l\in\mathcal{L}\setminus\mathcal{P}_{var}$.

Finally, the subset $\mathcal{P}$ can be obtained as the intersection of
$\mathcal{P}_{mean}$ and $\mathcal{P}_{var}$:

$\mathcal{P}=\mathcal{P}_{mean}\cap\mathcal{P}_{var}.$ (30)

Hyperparameters to tune. Following (24) and (27), the layer weights
$\\{q^{(l)}\\}_{l=1}^{L}$ in (23) are determined by the parameter vector
$Q\in\mathbb{R}^{6}$, which is defined as

$Q=(q_{cv},q_{bn},q_{fc},q_{en},p_{mean},p_{var}).$ (31)

Given a $Q$, by using the weighted loss function (23), one can obtain the
reconstructed data $(\hat{X}^{*},\hat{Y}^{*})$ by solving the following
optimization problem:

$(\hat{X}^{*},\hat{Y}^{*})=\arg\min_{\hat{X},\hat{Y}}\ell_{Q}(\hat{X},\hat{Y}).$
(32)

We then use Bayesian Optimization to choose a proper $Q$ for a better
reconstruction.

####  4.2.2 Choice of $Q$ by Bayesian Optimization

Objective function. As shown in (32), one can obtain the reconstructed data
$(\hat{X}^{*},\hat{Y}^{*})$ with a given $Q$. Then, the corresponding
reconstructed model update $\Delta\hat{\theta}^{*}_{t}$ can be calculated as
$\Delta\hat{\theta}^{*}_{t}=G_{t}(\hat{X}^{*},\hat{Y}^{*})$.

Let $f:\mathbb{R}^{6}\rightarrow\mathbb{R}$ be the objective function that
measures the distance between the reconstructed model update
$\Delta\hat{\theta}^{*}$ and the ground-truth model update $\Delta\theta$ in
the following form:

$f(Q)=\left\|\Delta\hat{\theta}^{*}_{t}-\Delta\theta_{t}\right\|^{2}.$ (33)

Finding the optimal $Q^{*}$ is equivalent to solving the following
optimization problem:

$Q^{*}=\arg\min_{Q}f(Q).$ (34)

For the above optimization problem, $f$ is a black box function that does not
have an analytic expression. Meanwhile, calculating $f$ is computationally
expensive since one has to complete a data reconstruction attack to obtain
$\Delta\hat{\theta}^{*}_{t}$. As a result, traditional parameter determination
methods like grid search are not feasible. To overcome the above difficulties,
we employ the Bayesian optimization [19] to solve (34).

A Bayesian optimization algorithm for (34). Bayesian optimization is a
powerful technique for optimizing black-box functions that are expensive to
evaluate and may have noise or other sources of uncertainty. In general,
Bayesian optimization iteratively uses a surrogate model to approximate the
black-box function and then employs an acquisition function to determine the
next set of parameters to evaluate.

As for the surrogate model, it works to approximate the black-box objective
function $f$, which is commonly chosen to be a Gaussian process (GP) [23].
Formally, a GP is a collection of random variables, any finite number of which
have a joint Gaussian distribution.

Given an initial set $\mathcal{O}=\left\\{(Q_{i},f(Q_{i}))\right\\}_{i=1}^{n}$
that contains $n$ pairs of the sampling points and their function values, the
resulting prior distribution can be given as

$\bm{f}\sim\mathcal{N}\left(\bm{\mu},\Sigma_{\bm{Q}\bm{Q}}\right),$ (35)

where $\bm{f}=\left(f(Q_{1}),\ldots,f(Q_{n})\right)^{\top}$,
$\bm{Q}=\left(Q_{1},\ldots,Q_{n}\right)^{\top}$,
$\bm{\mu}=\left(\mu\left(Q_{1}\right),\ldots,\mu\left(Q_{n}\right)\right)^{\top}$
with $\mu(\cdot)$ being the mean function and is commonly set to zero,
$\Sigma_{\bm{Q}\bm{Q}}\in\mathbb{R}^{n\times n}$ is the matrix of the
covariances with its $(i,j)$ entry being $\kappa\left(Q_{i},Q_{j}\right)$, and
$\kappa(\cdot,\cdot)$ is a positive definite kernel function, typically set to
the Gaussian kernel.

Then, we can infer the value of $f(Q)$ at a new point $Q$ by computing the
posterior distribution of $f(Q)$ given prior observations [23] as follows:

$\displaystyle f(Q)\mid\bm{f}$
$\displaystyle\sim\mathcal{N}\left(\mu_{Q},\sigma^{2}_{Q}\right),$ (36)
$\displaystyle\mu_{Q}$
$\displaystyle=\Sigma_{Q\bm{Q}}\Sigma_{\bm{Q}\bm{Q}}^{-1}\bm{f},$
$\displaystyle\sigma^{2}_{Q}$
$\displaystyle=\Sigma_{QQ}-\Sigma_{Q\bm{Q}}\Sigma_{\bm{Q}\bm{Q}}^{-1}\Sigma_{\bm{Q}Q}.$

As for the acquisition function, it is used to propose the parameters for the
next trial by trading off exploitation and exploration. Exploitation means
sampling at locations where the surrogate model predicts a high objective
value and exploration means sampling at locations where the prediction
uncertainty is high.

One of the most popular acquisition functions is Expected Improvement (EI)
[24]. Let $f_{\min}$ denote the best function value obtained so far. Then, the
improvement over $f_{\min}$ at point $Q$ can be defined as

$I(Q)=\max(f_{\min}-f(Q),0).$ (37)

The improvement $I(Q)$ is a random variable since
$f(Q)\sim\mathcal{N}\left(\mu_{Q},\sigma^{2}_{Q}\right)$ as shown in (36). To
obtain the expected improvement, we can take the expected value as follows:

$EI(Q)=\mathbb{E}[\max(f_{\min}-f(Q),0)].$ (38)

The expected improvement can be evaluated analytically under the GP [25],
given as:

$\displaystyle EI(Q)=$
$\displaystyle\left(f_{\min}-\mu_{Q}\right)\Phi\left(\frac{f_{\min}-\mu_{Q}}{\sigma_{Q}}\right)$
(39)
$\displaystyle+\sigma_{Q}\varphi\left(\frac{f_{\min}-\mu_{Q}}{\sigma_{Q}}\right),$

where $\varphi$ and $\Phi$ are the probability density and cumulative
distribution functions of the standard normal distribution, respectively. It
can be seen that $EI(Q)$ is higher for a point $Q$ predicted to have a smaller
$\mu_{Q}$ and a larger $\sigma_{Q}$, indicating the trade-off between
exploitation and exploration.

Given the $EI$, the parameter $Q_{n+1}$ for the next trial is chosen to be the
point with the largest expected improvement:

$Q_{n+1}=\arg\max_{Q}EI(Q).$ (40)

The evaluation of $EI(Q)$ is much easier than that of the function $f$ in
(34). The optimization problem (40) can be solved by some classic optimization
techniques such as Newton’s method.

###  4.3 Approximate and Weighted Data Reconstruction Attack Method

Based on the discussions in Sections 4.1-4.2, we propose an approximate and
weighted data reconstruction attack method and summarize it in Algorithm 2.

Algorithm 2 Approximate and Weighted Attack (AWA).

1: Intercept a client’s model update $\Delta\theta_{t}$ at round $t$.

2: Calculate approximate $\Delta\tilde{\theta}_{t,e}$ and $G_{t,e}$.
$\quad\triangleright$ (20)

3: Initialize an empty set $\mathcal{O}$.

4: for each trial $i=1,2,...,n$ do

5: Generate a random test point $Q_{i}$.

6: Obtain $\hat{X}$,
$\hat{Y},f(Q_{i})\leftarrow\textbf{RecAttack}(Q_{i},\Delta\tilde{\theta}_{t,e},G_{t,e})$.

7: Update $\mathcal{O}:=\mathcal{O}\cup\\{(Q_{i},f(Q_{i}))\\}$.

8: end for

9: for each trial $i=n+1,n+2,...,N_{BO}$ do

10: Fit GP over $f$ with samples in $\mathcal{O}$. $\quad\triangleright$ (35)

11: Choose $Q_{i}$ with the largest EI. $\quad\triangleright$ (40)

12: Obtain $\hat{X}$,
$\hat{Y},f(Q_{i})\leftarrow\textbf{RecAttack}(Q_{i},\Delta\tilde{\theta}_{t,e},G_{t,e})$.

13: Update $\mathcal{O}:=\mathcal{O}\cup\\{(Q_{i},f(Q_{i}))\\}$.

14: end for

15: Get $Q^{*}=\arg\min_{Q_{i}}\\{f(Q_{i})\\}_{i=1}^{N_{BO}}$.

16: Obtain
$\hat{X}^{*},\hat{Y}^{*},f(Q^{*})\leftarrow\textbf{RecAttack}(Q^{*},\Delta\tilde{\theta}_{t,e},G_{t,e})$.

17: return $\hat{X}^{*}$, $\hat{Y}^{*}$.

1: $\textbf{RecAttack}(Q_{i},\Delta\tilde{\theta}_{t,e},G_{t,e}):$

2: Initialize the dummy data $(\hat{X},\hat{Y})$ and set $Q:=Q_{i}$.

3: for each attack iteration from 1 to $N_{AT}$ do

4: Compute $\Delta\hat{\theta}_{t,e}=G_{t,e}(\hat{X},\hat{Y})$.

5: Calculate $\\{q^{(l)}\\}_{l=1}^{L}$ based on $Q$. $\quad\triangleright$
(24)

6: Select layers $l\in\mathcal{P}$ with the largest errors.
$\quad\triangleright$ (30)

7: Set $q^{(l)}=q_{en},\forall l\in\mathcal{P}$ based on $Q$.
$\quad\triangleright$ (27)

8: Calculate
$\ell_{Q}(\hat{X},\hat{Y})=\sum_{l=1}^{L}q^{(l)}\|\Delta\hat{\theta}_{t,e}^{(l)}-\Delta\tilde{\theta}_{t,e}^{(l)}\|^{2}$,

9: Update
$\hat{X}:=\hat{X}-\hat{\eta}\nabla_{\hat{X}}\ell_{Q}(\hat{X},\hat{Y})$,

10: Update
$\hat{Y}:=\hat{Y}-\hat{\eta}\nabla_{\hat{Y}}\ell_{Q}(\hat{X},\hat{Y})$.

11: end for

12: Calculate
$f(Q)=\|G_{t,e}(\hat{X},\hat{Y})-\Delta\tilde{\theta}_{t,e}\|^{2}$.

13: return $\hat{X}$, $\hat{Y},f(Q)$.

##  5 Experimental Tests

In this section, we conduct numerical experiments to validate the
effectiveness of our proposed AWA method given in Algorithm 2. We first
introduce experimental environments and implementation details used in our
experiments. We then explain the choice of hyperparameters and describe the
evaluation metrics. Finally, we test our proposed AWA method for image data
reconstructions and compare its performance with two state-of-the-art methods,
namely AGIC [7] and DLG [9]), in attacking various FedAvg scenarios.

###  5.1 Setups

Hardware. For all the experiments, we use a computer equipped with an Xeon
E5-2680 v4 CPU, 32GB of RAM, and an NVIDIA GeForce RTX 1080 Ti GPU.

Implementation details. To implement the FedAvg, we select images from the
training set of CIFAR-10 [18] (color images of 10 categories, size 32×32) as
the clients’ ground-truth data. The model used by each client is the ResNet18
[22]. The client’s local training process employs stochastic gradient descent
with a learning rate of 0.001. For the attack optimizations, the Adam
optimizer [16] with a learning rate of 0.1 is used and each attack runs for
1,000 iterations. Following the label inference method in [6, 8], we proceed
with the assumption that the label information is known. Table I lists the
simulation scenarios of the data reconstruction attack.

TABLE I: Simulation settings of the data reconstruction attack. Client’s dataset | CIFAR-10
---|---
Client’s neural network | ResNet18
Attack optimizer | Adam
Attack learning rate | 0.1
Attack iterations | 1,000

In our AWA method, the parameter $Q$ defined by (31) is selected by using
Bayesian optimization, where we use the Gaussian process (36) as the surrogate
model and the expected improvement (39) as the acquisition function. The
objective function of Bayesian optimization is the squared Euclidean norm of
the dummy model update $\Delta\hat{\theta}^{*}$ and the ground-truth model
update $\Delta\theta$ as defined in (33). We run Bayesian optimization for
$N_{BO}=50$ iterations, with the first $n=12$ iterations initiating the
dataset $\mathcal{O}$. The search ranges of $Q$ are listed in Table II.

TABLE II: Search ranges of $Q$ in Bayesian optimization. Parameters | Search ranges
---|---
$q_{cv}$ | [1, 1000]
$q_{bn}$ | [1, 1000]
$q_{fc}$ | [1, 1000]
$q_{en}$ | [1, 1000]
$p_{mean}$ | [0, 0.5]
$p_{var}$ | [0, 0.5]

Evaluation metrics. To evaluate the efficiency of the attack and the quality
of the data reconstruction, we use three different metrics to measure the
dissimilarity between reconstructed data and the ground-truth data: pixel-wise
Mean Square Error (MSE) [26], Peak Signal-to-Noise Ratio (PSNR) [26], and
Structural Similarity Index Measure (SSIM) [27]. The above three metrics are
prevalent and appropriate indicators in evaluating the effect of image
reconstruction [26], and they have been widely used in evaluating the existing
data reconstruction attacks, see e.g., [11, 14, 8].

  * •

MSE quantifies the discrepancy between the ground-truth image $\bm{D}$ and the
reconstructed image $\bm{D^{\prime}}$, and it is defined as

$\operatorname{MSE}(\bm{D},\bm{D^{\prime}})=\frac{1}{d_{m}d_{n}}\sum_{i=1}^{d_{m}}\sum_{j=1}^{d_{n}}[\bm{D}(i,j)-\bm{D^{\prime}}(i,j)]^{2},$

where $d_{m}\times d_{n}$ is the image size, $\bm{D}(i,j)$ and
$\bm{D^{\prime}}(i,j)$ represent the pixel values at coordinates $(i,j)$ of
$\bm{D}$ and $\bm{D^{\prime}}$. A smaller MSE indicates a better
reconstruction quality.

  * •

PSNR represents the rate of the maximum possible signal power to the
distortion noise power. PSNR can be calculated as

$\operatorname{PSNR}(\bm{D},\bm{D^{\prime}})=10\log_{10}\frac{\operatorname{max}_{\bm{D}}^{2}}{\operatorname{MSE}(\bm{D},\bm{D^{\prime}})},$

where $\operatorname{max}_{\bm{D}}$ is the maximum pixel value in the ground-
truth image $\bm{D}$. It is easy to see that the larger the PSNR value, the
better the image reconstruction quality.

  * •

SSIM measures the structural similarity between the ground-truth and
reconstructed images. The value of SSIM ranges between zero and one, and a
higher value indicates a better reconstruction. To be concrete, SSIM is
calculated as

$\operatorname{SSIM}(\bm{D},\bm{D^{\prime}})=\frac{\left(2\mu_{\bm{D}}\mu_{\bm{D^{\prime}}}+c_{1}\right)\left(2\sigma_{\bm{D}\bm{D^{\prime}}}+c_{2}\right)}{\left(\mu_{\bm{D}}^{2}+\mu_{\bm{D^{\prime}}}^{2}+c_{1}\right)\left(\sigma_{\bm{D}}^{2}+\sigma_{\bm{D^{\prime}}}^{2}+c_{2}\right)}.$

Here, $\mu_{\bm{D}}$ and $\mu_{\bm{D^{\prime}}}$ are the average pixel values
of $\bm{D}$ and $\bm{D^{\prime}}$, $\sigma_{\bm{D}}$ and
$\sigma_{\bm{D^{\prime}}}$ are the standard deviations of pixel values of
$\bm{D}$ and $\bm{D^{\prime}}$, $\sigma_{\bm{D}\bm{D^{\prime}}}$ is the
covariance of $\bm{D}$ and $\bm{D^{\prime}}$, $c_{1}=\left(k_{1}H\right)^{2}$
and $c_{2}=\left(k_{2}H\right)^{2}$ are constants with $k_{1}=0.01$,
$k_{2}=0.03$, and $H$ being the range of the pixel values.

###  5.2  Results for Image Data Reconstruction Attacks

To verify the feasibility and effectiveness of our proposed AWA method, we
test it in image data reconstruction attacks and compared the results with two
state-of-the-art attack methods (AGIC [7] and DLG [9]) under the following
four different FedAvg scenarios:

  * •

Case 1: $N=4$, $E=1$, and $B=1$;

  * •

Case 2: $N=4$, $E=4$, and $B=1$;

  * •

Case 3: $N=4$, $E=1$, and $B=4$;

  * •

Case 4: $N=4$, $E=2$, and $B=2$.

Recall the analysis in Section 3, when $E>1$ and $B>1$, the attacker has to
use an approximate method for the attack. Therefore, only AWA and AGIC can
conduct the attack for Case 4. The approximate strategy of each method is
given below. Our proposed AWA method uses (20) to get the approximate
intermediate model updates $\Delta\tilde{\theta}_{t,e}$ in each epoch
$e=1,2,\ldots,E$. Then, the attacker can reconstruct the client’s dataset by
using any of the $\Delta\tilde{\theta}_{t,e}$ and the corresponding $G_{t,e}$.
In Case 4 with $E=2$, we have two options: $\Delta\tilde{\theta}_{t,1}$ and
$\Delta\tilde{\theta}_{t,2}$. In the following test, we choose
$\Delta\tilde{\theta}_{t,1}$ as the target model update for the
reconstruction. On the other hand, AGIC assumes that a combined batch
consisting of all the mini-batches used in the client’s local training process
can approximate the received model update in a single local update step. For
this purpose, it assumes all the mini-batches used in the client’s local
training form a combined batch. Then, the dummy model update is calculated by
doing a full-batch gradient descent using the combined batch.

In all the tests, the DLG method utilizes the unweighted loss function (10)
for the attack, while the AGIC method employs a weighted cosine similarity
loss function by assigning linearly increasing weights to convolutional and
fully connected layers. However, these weights are assigned empirically and
not tailored case by case. In contrast, the AWA method employs the weighted
and enhanced loss function (23) for the attack, with the layer weights
determined by (24) and (27). The values of $Q$ are selected by utilizing
Bayesian optimization. The cumulative minimum loss $f(Q)$ of Bayesian
optimization in 50 trials is presented in Figure 1. It can be seen that the
Bayesian optimization approach successfully finds a trend of smaller $f(Q)$
values as the trial count increases. Finally, the parameter settings refined
by Bayesian optimization for our AWA method in each case are listed in Table
III.

Figure 1: Cumulative minimum loss $f(Q)$ of Bayesian optimization in four cases. TABLE III: Parameter settings tuned by Bayesian optimization for our AWA method in four cases. Parameters | Case 1 | Case 2 | Case 3 | Case 4
---|---|---|---|---
$q_{cv}$ | 519.19 | 236.31 | 547.17 | 655.98
$q_{bn}$ | 802.55 | 552.31 | 222.48 | 692.94
$q_{fc}$ | 42.83 | 54.28 | 394.39 | 283.42
$q_{en}$ | 946.44 | 837.80 | 899.47 | 665.28
$p_{mean}$ | 0.24 | 0.11 | 0.31 | 0.40
$p_{var}$ | 0.07 | 0.13 | 0.01 | 0.33

The numerical comparisons of the above three data reconstruction attack
methods for Cases 1-4 are presented in Figure 2 and Table IV. We observe that
in all four cases, our proposed AWA method consistently yields images with
substantially enhanced resolution compared to those obtained by DLG and AGIC.
This is further validated by the consistently highest values of PSNR and SSIM
achieved by AWA in each case. Another noteworthy finding is the consistency in
the reconstruction qualities of images produced by our AWA method across the
diverse FedAvg cases, which demonstrates the robustness of our proposed
approach.

Figure 2: Comparison of the reconstruction results achieved by three data reconstruction methods in four FedAvg scenarios after 1,000 attack iterations. FedAvg parameters: batch size $N$, number of epochs $E$, number of mini-batches $B$. Methods: AWA (ours): reconstruction with the method in Algorithm 2, AGIC: reconstruction with the method in [7], DLG: reconstruction with the method in [9]. TABLE IV: Detailed evaluation metrics of the data reconstructed by three data reconstruction methods in four cases. | Metrics | DLG | AGIC | AWA(ours)
---|---|---|---|---
Case 1 | PSNR | 14.06 | 15.89 | 22.40
SSIM | 0.534 | 0.689 | 0.935
MSE | 0.042 | 0.028 | 0.006
Case 2 | PSNR | 16.43 | 16.07 | 20.40
SSIM | 0.739 | 0.631 | 0.901
MSE | 0.024 | 0.035 | 0.009
Case 3 | PSNR | 14.05 | 15.63 | 22.47
SSIM | 0.505 | 0.718 | 0.936
MSE | 0.044 | 0.029 | 0.006
Case 4 | PSNR | - | 16.41 | 19.68
SSIM | - | 0.734 | 0.882
MSE | - | 0.025 | 0.011

In Case 4, where $E>1$ and $B>1$, DLG encounters difficulties in performing
the attack due to the absence of an approximate strategy. On the other hand,
although AGIC incorporates an approximate strategy, it fails to reconstruct
images with identifiable objects effectively. In sharp contrast, the proposed
AWA method demonstrates its capability to successfully reconstruct images with
reasonable resolutions, overcoming the limitations faced by DLG and AGIC.
Furthermore, the PSNR of images reconstructed in Case 4 is found to be
comparable to that achieved in the first three cases, which strongly suggests
the effectiveness of our proposed approximate strategy.

Furthermore, we present the reconstruction results of our AWA method after
3,000 attack iterations in four cases in Figure 3 and Figure 4. All the other
parameters maintain the same as listed in Table I. The resulting reconstructed
images and the corresponding SSIM metrics for each case are represented in
Figure 3. Evidently, the attained SSIM values surpass those presented in Table
IV for the 1000-iteration attack. The results clearly show a significant
visual proximity between the reconstructed images and their ground-truth
counterparts. Additionally, Figure 4 presents the evaluation metrics PSNR and
SSIM, as well as the cumulative minimum value of the weighted loss during the
attack across all four cases. It is evident that our method achieves a
satisfactory level of reconstruction, with SSIM values exceeding 0.9 within
1500 attack iterations for all four cases. The outcomes of Case 4 exhibit a
marginally inferior performance compared to Cases 1-3 due to the need for
approximation. However, the reconstructed images in Case 4 remain sufficiently
clear to facilitate object identification. These results further validate the
effectiveness of our proposed AWA method.

Figure 3: Reconstruction results of our AWA method in four cases after 3,000
attack iterations.

(a) PSNR.

(b) SSIM.

(c) Weighted Loss.

Figure 4: Evaluation metrics of our AWA method in four cases after 3,000
attack iterations.

Overall, the aforementioned results demonstrate a substantial improvement in
reconstruction achieved by our AWA method. The comprehensive evaluation
strongly supports the superiority of our method AWA in data reconstruction
attacks against various FedAvg scenarios.

##  6 Conclusions

The privacy benefits of federated learning (FL) are compromised by recently
developed data reconstruction attacks. In this paper, we first formulate the
attack as an inverse problem, allowing us to reconstruct the client’s training
data iteratively by solving an optimization problem. To attack the widely used
federated averaging (FedAvg) scenario, we propose an interpolation-based
approximation method, where the intermediate model updates corresponding to
each epoch are approximated by interpolating the model parameters.
Furthermore, we propose a layer-wise weighted and enhanced loss function for
the attack to improve the quality of reconstructed data. By assigning
appropriate weights to model updates in different layers by using the Bayesian
optimization method, we achieve superior reconstruction results compared to
the existing state-of-the-art methods. Moreover, our method is compatible with
various neural network architectures like Convolutional Neural Networks and
Residual Neural Networks. Numerical results validate that our proposed
approximate and weighted data reconstruction attack method is effective for
adversaries to exploit the vulnerabilities of FL systems utilizing the FedAvg
algorithm. The ability to reconstruct data from intermediate model updates
highlights the need for robust defense mechanisms. Future research could focus
on developing countermeasures and enhancing the security of FL frameworks to
mitigate the risks associated with such attacks.

## Acknowledgments

This work has been funded by the Humboldt Research Fellowship for postdoctoral
researchers, the Alexander von Humboldt-Professorship program, the European
Union’s Horizon Europe MSCA project ModConFlex (grant number 101073558), the
COST Action MAT-DYN-NET, the Transregio 154 Project of the DFG, grants
PID2020-112617GB-C22 and TED2021-131390B-I00 of MINECO (Spain). Madrid
Government - UAM Agreement for the Excellence of the University Research Staff
in the context of the V PRICIT (Regional Programme of Research and
Technological Innovation).

## References

  * [1] Tian Li, Anit Kumar Sahu, Ameet Talwalkar and Virginia Smith  “Federated Learning: Challenges, Methods, and Future Directions”  In _IEEE Signal Processing Magazine_ 37.3, 2020, pp. 50–60  DOI: 10.1109/MSP.2020.2975749
  * [2] Brendan McMahan et al.  “Communication-Efficient Learning of Deep Networks from Decentralized Data”  In _Proceedings of the 20th International Conference on Artificial Intelligence and Statistics_ PMLR, 2017, pp. 1273–1282
  * [3] Theodora S. Brisimi et al.  “Federated Learning of Predictive Models from Federated Electronic Health Records”  In _International Journal of Medical Informatics_ 112, 2018, pp. 59–67  DOI: 10.1016/j.ijmedinf.2018.01.007
  * [4] Jie Xu et al.  “Federated Learning for Healthcare Informatics”  In _Journal of Healthcare Informatics Research_ 5.1, 2021, pp. 1–19  DOI: 10.1007/s41666-020-00082-4
  * [5] Tengchan Zeng et al.  “Federated Learning on the Road Autonomous Controller Design for Connected and Autonomous Vehicles”  In _IEEE Transactions on Wireless Communications_ 21.12, 2022, pp. 10407–10423  DOI: 10.1109/TWC.2022.3183996
  * [6] Jiahui Geng et al.  “Improved Gradient Inversion Attacks and Defenses in Federated Learning”  In _IEEE Transactions on Big Data_ , 2023, pp. 1–13  DOI: 10.1109/TBDATA.2023.3239116
  * [7] Jin Xu et al.  “AGIC: Approximate Gradient Inversion Attack on Federated Learning”  In _2022 41st International Symposium on Reliable Distributed Systems (SRDS)_ , 2022, pp. 12–22  DOI: 10.1109/SRDS55811.2022.00012
  * [8] Hongxu Yin et al.  “See through Gradients: Image Batch Recovery via Gradinversion”  In _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2021, pp. 16337–16346
  * [9] Ligeng Zhu, Zhijian Liu and Song Han  “Deep Leakage from Gradients”  In _Advances in Neural Information Processing Systems_ 32 Curran Associates, Inc., 2019
  * [10] Bo Zhao, Konda Reddy Mopuri and Hakan Bilen  “iDLG: Improved Deep Leakage from Gradients”  In _arXiv preprint arXiv:2001.02610_ , 2020
  * [11] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge and Michael Moeller  “Inverting Gradients - How Easy Is It to Break Privacy in Federated Learning?”  In _Advances in Neural Information Processing Systems_ 33 Curran Associates, Inc., 2020, pp. 16937–16947
  * [12] Yijue Wang et al.  “SAPAG: A Self-Adaptive Privacy Attack From Gradients”  In _arXiv preprint arXiv:2009.06228_ , 2020
  * [13] Jinwoo Jeon et al.  “Gradient Inversion with Generative Image Prior”  In _Advances in Neural Information Processing Systems_ 34 Curran Associates, Inc., 2021, pp. 29898–29908
  * [14] Wenqi Wei et al.  “A Framework for Evaluating Client Privacy Leakages in Federated Learning”  In _Computer Security – ESORICS 2020_ , Lecture Notes in Computer Science  Cham: Springer International Publishing, 2020, pp. 545–566  DOI: 10.1007/978-3-030-58951-6˙27
  * [15] Dong C. Liu and Jorge Nocedal  “On the Limited Memory BFGS Method for Large Scale Optimization”  In _Mathematical Programming_ 45.1, 1989, pp. 503–528  DOI: 10.1007/BF01589116
  * [16] Diederik P. Kingma and Jimmy Ba  “Adam: A Method for Stochastic Optimization”  In _arXiv preprint arXiv:1412.6980_ , 2017
  * [17] Gary B. Huang, Marwan Mattar, Tamara Berg and Eric Learned-Miller  “Labeled Faces in the Wild: A Database forStudying Face Recognition in Unconstrained Environments”  In _Workshop on Faces in ’Real-Life’ Images: Detection, Alignment, and Recognition_ , 2008
  * [18] Alex Krizhevsky and Geoffrey Hinton  “Learning Multiple Layers of Features from Tiny Images”  Toronto, ON, Canada, 2009
  * [19] Peter I. Frazier  “A Tutorial on Bayesian Optimization”  In _arXiv preprint arXiv:1807.02811_ , 2018
  * [20] Ovidiu Calin  “Deep Learning Architectures: A Mathematical Approach”, Springer Series in the Data Sciences  Cham: Springer International Publishing, 2020  DOI: 10.1007/978-3-030-36721-3
  * [21] Shi Chen and Qi Zhao  “Shallowing Deep Networks: Layer-Wise Pruning Based on Feature Representations”  In _IEEE Transactions on Pattern Analysis and Machine Intelligence_ 41.12, 2019, pp. 3048–3056  DOI: 10.1109/TPAMI.2018.2874634
  * [22] Kaiming He, Xiangyu Zhang, Shaoqing Ren and Jian Sun  “Deep Residual Learning for Image Recognition”  In _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2016, pp. 770–778
  * [23] Carl Edward Rasmussen and Christopher K. I. Williams  “Gaussian Processes for Machine Learning”, Adaptive Computation and Machine Learning  Cambridge, Mass: MIT Press, 2006
  * [24] Jonas Močkus  “On Bayesian Methods for Seeking the Extremum”  In _Optimization Techniques IFIP Technical Conference: Novosibirsk, July 1–7, 1974_ Springer, 1975, pp. 400–404
  * [25] Donald R. Jones, Matthias Schonlau and William J. Welch  “Efficient Global Optimization of Expensive Black-Box Functions”  In _Journal of Global Optimization_ 13.4, 1998, pp. 455–492  DOI: 10.1023/A:1008306431147
  * [26] Umme Sara, Morium Akter and Mohammad Shorif Uddin  “Image Quality Assessment through FSIM, SSIM, MSE and PSNR—A Comparative Study”  In _Journal of Computer and Communications_ 7.3 Scientific Research Publishing, 2019, pp. 8–18  DOI: 10.4236/jcc.2019.73002
  * [27] Zhou Wang, A.C. Bovik, H.R. Sheikh and E.P. Simoncelli  “Image Quality Assessment: From Error Visibility to Structural Similarity”  In _IEEE Transactions on Image Processing_ 13.4, 2004, pp. 600–612  DOI: 10.1109/TIP.2003.819861