Inverting Gradients -- How easy is it to break privacy in federated learning?

The idea of federated learning is to collaboratively train a neural network\non a server. Each user receives the current weights of the network and in turns\nsends parameter updates (gradients) based on local data. This protocol has been\ndesigned not only to train neural networks data-efficiently, but also to\nprovide privacy benefits for users, as their input data remains on device and\nonly parameter gradients are shared. But how secure is sharing parameter\ngradients? Previous attacks have provided a false sense of security, by\nsucceeding only in contrived settings - even for a single image. However, by\nexploiting a magnitude-invariant loss along with optimization strategies based\non adversarial attacks, we show that is is actually possible to faithfully\nreconstruct images at high resolution from the knowledge of their parameter\ngradients, and demonstrate that such a break of privacy is possible even for\ntrained deep networks. We analyze the effects of architecture as well as\nparameters on the difficulty of reconstructing an input image and prove that\nany input to a fully connected layer can be reconstructed analytically\nindependent of the remaining architecture. Finally we discuss settings\nencountered in practice and show that even averaging gradients over several\niterations or several images does not protect the user's privacy in federated\nlearning applications in computer vision.\n