Summary
This paper introduces a novel approach to input reconstruction for neural networks, focusing specifically on linear layers followed by ReLU activations.
The key aspects of this method are:
Low-rank decomposition: The authors leverage low-rank matrix decomposition techniques to simplify the representation of the linear layer's weight matrix.
ReLU sparsity exploitation: The method takes advantage of the sparsity induced by the ReLU activation function following the linear layer. This sparsity provides additional constraints that aid in the reconstruction process.
Efficient disaggregation algorithm: A core contribution of the paper is an efficient algorithm for searching the columns of the disaggregation matrix Q. This matrix plays a crucial role in the reconstruction process.
Input reconstruction: By combining these elements, the authors demonstrate a method to reconstruct input examples from the output of a linear layer followed by a ReLU activation.
Strengths
Its a really interesting idea to reconstruct from gradients and provide a mathematical explanation of previous work [1] (from the paper’s citation) and this work.
Proof is clean and precise. Also discuss many settings, like layer width and batch size. It also provides a theory bound for failure probability in reconstruction attacks.
The reconstruction result and reuse quality for reconstruction images are really good.
[1] Kariyappa, Sanjay, et al. "Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis." International Conference on Machine Learning. PMLR, 2023.
Weaknesses
It performs better than [1] in the reconstruction result, but the batch size would be a bottleneck since the method is bound by batch size to resolve, and [1] can reach out to batch size > 64 easily.
Interesting idea but miss some experiments and discussion:
1. It only provides experiments run on 1st linear layer setting. However, in many NN designs, linear layers are usually after the conv layer or before softmax. Could you provide a more detailed discussion about using your method for linear layer after conv layers in more practical setting? like [9]’s section 4
2. In the supplement code section, it only provides experiments based on relu1 and fc1, Could you run quick experiments and report performance on different/later fc layers?
If the result is limited to the first fc layer, then it has some interesting innovation in method design but is not really practical.
Also, if authors can provide more no cherry-picking visualization results on different fc layers or fc after conv for different datasets in the appendix,?
For E6 DPSGD part, usually sigma = 1*10-4 is considered to be really large eps and too little noise, which is not considered practical privacy protection. For DPSGD on linear layer NN, sigma = 0.01 with some reasonable setting can be considered as eps = 80–100 ( I might calculate wrong but its around that number), which is still not useful for DPSGD.
[1] Kariyappa, Sanjay, et al. "Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis." International Conference on Machine Learning. PMLR, 2023.