OFLGI: An Optimization-based Feature-Level Gradient Inversion Attack

Federated learning has become the leading paradigm for privacy-preserving distributed learning, as it only requires the upload of model gradients, not private data. However, recent studies have shown that these exchanged gradients can still lead to privacy leakage; for instance, attackers can recover private images through optimization-based gradient inversion attacks. In these attacks, pixel values in a dummy image are iteratively updated to approximate those of the private image. Yet, such optimization-based attacks often face challenges due to the large search space of the optimization task and struggle to accurately recover all labels in a batch. To tackle these, we propose the Optimization-based Feature-Level Gradient Inversion (OFLGI) attack, which focuses on optimizing image features rather than pixel values. This approach reduces the search space of the optimization task and enhances the quality of the reconstructed images. Our method formulates an optimization task to convert random noise features into natural image features, matching gradients while regularizing image fidelity. Notably, we are the first to utilize image features for gradient inversion attacks. Additionally, we introduce a novel batch label reconstruction algorithm that leverages the gradients of the biases in the final fully connected layer, surpassing existing methods even in the presence of duplicate labels. Furthermore, OFLGI demonstrates superior resistance to multiple gradient defense strategies, being able to recover high-quality private images even from degraded gradients. Extensive experiments have demonstrated the superiority of OFLGI over state-of-the-art gradient inversion techniques.