Timezone: »

 
Poster
Cocktail Party Attack: Breaking Aggregation-Based Privacy in Federated Learning Using Independent Component Analysis
Sanjay Kariyappa · Chuan Guo · Kiwan Maeng · Wenjie Xiong · G. Edward Suh · Moinuddin Qureshi · Hsien-Hsin Sean Lee

Tue Jul 25 02:00 PM -- 04:30 PM (PDT) @ Exhibit Hall 1 #630
in Poster Session 1 »

Federated learning (FL) aims to perform privacy-preserving machine learning on distributed data held by multiple data owners. To this end, FL requires the data owners to perform training locally and share the gradients or weight updates (instead of the private inputs) with the central server, which are then securely aggregated over multiple data owners. Although aggregation by itself does not offer provable privacy protection, prior work suggested that if the batch size is sufficiently large the aggregation may be secure enough. In this paper, we propose the Cocktail Party Attack (CPA) that, contrary to prior belief, is able to recover the private inputs from gradients/weight updates aggregated over as many as 1024 samples. CPA leverages the crucial insight that aggregate gradients from a fully connected (FC) layer is a linear combination of its inputs, which allows us to frame gradient inversion as a blind source separation (BSS) problem. We adapt independent component analysis (ICA)---a classic solution to the BSS problem---to recover private inputs for FC and convolutional networks, and show that CPA significantly outperforms prior gradient inversion attacks, scales to ImageNet-sized inputs, and works on large batch sizes of up to 1024.

[ PDF]  [ Poster] 

Author Information

Sanjay Kariyappa (JP Morgan Chase)
Chuan Guo (Meta AI)
Kiwan Maeng (Pennsylvania State University)
Wenjie Xiong (Virginia Polytechnic Institute and State University)
G. Edward Suh (Meta AI)
Moinuddin Qureshi (Georgia Institute of Technology)
Hsien-Hsin Sean Lee (Intel)

More from the Same Authors