Research map / Federated learning and privacy / Privacy attacks and secure learning
Concealing Sensitive Samples against Gradient Leakage in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DCS² (Defense by Concealing Sensitive Samples), which synthesizes visually dissimilar concealed samples whose gradients mimic sensitive data and projects the batch gradient to stay aligned with the original, defending federated learning against gradient-inversion attacks.
Problem
Model inversion / gradient leakage attacks in federated learning can reconstruct private training data from shared gradients, and existing defenses (noise, pruning, Soteria, ATS, PRECODE) either fail against stronger attacks or hurt FL accuracy.
Approach
Exploits the low entanglement of per-sample gradients within a batch: synthesize concealed samples whose gradients match the sensitive sample's gradient but which look visually different, mix their loss into the batch gradient, and apply a QP-based gradient projection so the shared gradient stays aligned with the original batch gradient.
Key results
- On MNIST against GS attack, DCS² reaches PSNR 7.84 and SSIM 0.17 with 86.98% sensitive-data accuracy, matching the no-defense accuracy while Soteria gets PSNR 9.67.
- On TinyImageNet against the Imprint attack, DCS² raises LPIPS from 0.00 (no defense) to 0.22 and keeps test accuracy at 65.68% vs 66.41% without defense.
- On CIFAR10 against GS attack, DCS² reduces SSIM to 0.15 while other defenses reach about 0.22–0.29, with test accuracy 79.79%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use DCS² instead of Soteria | FL on MNIST · MNIST, GS attack | PSNR: 9.67 -> 7.84 | Helped |
| use DCS² instead of Prune | FL on CIFAR10 · CIFAR10, GS attack | SSIM: 0.22 -> 0.15 | Helped |
| use DCS² instead of Soteria | FL on CelebA · CelebA, GGL attack | SSIM: 0.24 -> 0.17 | Helped |
| use DCS² instead of Prune | FL on TinyImageNet · TinyImageNet, Imprint attack | LPIPS: 0.16 -> 0.22 | Helped |
| increase λg from 0.5 to 1.0 (ablation) | DCS² on TinyImageNet · TinyImageNet, Imprint attack | SSIM: 0.80 -> 0.78 | Helped |
| increase λg from 0.5 to 1.0 (ablation) | DCS² on TinyImageNet · TinyImageNet | test accuracy: 65.76 -> 65.24 | Hurt |
| use noise initialization with MixUP instead of non-noise initialization without MixUP (ablation) | DCS² on MNIST · MNIST, GS attack | PSNR: 7.40 -> 7.97 | Mixed |
| combine Prune with DCS² (ablation) | DCS² on MNIST · MNIST, GS attack | PSNR: 7.84 -> 6.08 | Helped |
| combine Prune with DCS² (ablation) | DCS² on MNIST · MNIST, GS attack | test accuracy: 86.98 -> 86.92 | No clear effect |
| use DCS² instead of ATS | FL on CIFAR10 · CIFAR10, GS attack | PSNR: 19.68 -> 8.04 | Helped |
| use DCS² instead of ATS | FL on CIFAR10 · CIFAR10 test set | accuracy: 75.70 -> 79.79 | Helped |
| use DCS² instead of Soteria | FL on MNIST · MNIST test set | accuracy: 86.94 -> 86.98 | No clear effect |
Surprising findings
- Concealed samples can be initialized from random noise or from a different domain (CIFAR10 for CelebA) and still provide protection and retain accuracy.
- Combining DCS² with Prune yields stronger protection (PSNR 6.08, SSIM 0.12) than either alone.
Limitations
- Requires additional computation to craft concealed samples (about 1.7x per-round time on TinyImageNet).
- Vulnerable to adaptive adversaries with strong priors (GGL) or architecture modification (Imprint); concealed samples may be identifiable by a filtering mechanism.
Experimental setup
Datasets: MNIST CIFAR10 CelebA TinyImageNet
Benchmarks: MNIST CIFAR10 CelebA TinyImageNet
Metrics: PSNR SSIM LPIPS accuracy on sensitive data accuracy on test set
Baselines: DP-Gaussian Prune Soteria ATS None
Builds on: Deep Leakage from Gradients FedAvg mixup Soteria Prune gradient compression
Closest papers by meaning
- Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective (AAAI 2024 · similarity 0.90)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.89)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.89)
- Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · similarity 0.89)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.88)
- Revamping Federated Learning Security from a Defender's Perspective: A Unified Defense with Homomorphic Encrypted Data Space (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.