Anti-FT: Towards Practical Deep Leakage From Gradients

Federated learning is usually regarded as a privacy-preserving training paradigm for it enables multiple clients to participate in a training task without sharing their private data. However, recent studies revealed that a malicious server can still recover private data from the victim clients based on the shared gradients via deep leakage from gradients (DLG). Currently, almost all DLG attacks are designed based on the average loss, leading to a significant decrease in attack efficiency when the batch size is greater than 1. In this paper, we revisit DLG attacks from the perspective of the loss function. We reveal that not all samples in the target batch are equally susceptible to DLG attacks: the sample with the highest loss value tends to be easily recovered by DLG attacks. Based on these observations, we propose a simple yet effective DLG method under practical FL settings. Specifically, the adversaries can enhance the effectiveness of DLG by perturbing the global model through finetuning it with a few mislabeled samples (dubbed ‘Anti-FT’). Extensive experiments are conducted on benchmark datasets, which verify the effectiveness of our method and its resistance to potential defenses. The codes are available at https://github.com/zlh-thu/anti-finetune.