Research map / Federated learning and privacy / Privacy attacks and secure learning
Mjölnir: Breaking the Shield of Perturbation-Protected Gradients via Adaptive Diffusion
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Mjölnir, a diffusion-based gradient denoising attack that removes Gaussian/Laplace perturbations from federated learning gradients, using a surrogate model and an adaptive perturbation-level parameter to recover private training data.
Problem
Gradient perturbation defenses such as differential privacy are assumed to block gradient leakage attacks; the paper asks whether attackers can denoise perturbed gradients in federated learning without the original model or external data to recover private images.
Approach
Train a DDPM-style gradient diffusion model on gradients from a surrogate model built from the stolen perturbed gradients' structure, then denoise intercepted gradients with a reverse process whose starting step is set from the perturbation level M (adaptive sampling), so that existing gradient inversion attacks can recover data.
Key results
- Under FL-DP (epsilon=10, delta=1e-5) on MNIST, Mjölnir (Conditional) reaches 35.14 PSNR_i and 0.957 LRA versus 20.19 PSNR for the best baseline GRNN.
- On gradient denoising under FL-DP, Mjölnir achieves average cosine similarity above 0.992 and PSNR_g of 37.68, reported as over 27% better than non-diffusion denoisers.
- Under FL-PP with Laplace and Gaussian noise, Mjölnir variants improve PSNR by about 21% and cosine similarity by about 9% on average over non-diffusion methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use Mjölnir instead of GRNN on MNIST at ε=10 | Gradient leakage attack · MNIST, ε=10 | PSNR_i: 20.19 -> 33.09 | Helped |
| Use Mjölnir instead of GRNN on CIFAR100 at ε=10 | Gradient leakage attack · CIFAR100, ε=10 | PSNR_i: 21.15 -> 21.32 | Helped |
| Use Mjölnir instead of GRNN on STL10 at ε=10 | Gradient leakage attack · STL10, ε=10 | PSNR_i: 20.98 -> 19.77 | Hurt |
| Add the M-Adaptive Process (ablation) | Mjölnir · MNIST, ε=10 | PSNR_i: 32.98 -> 33.09 | Helped |
| Add the M-Adaptive Process (ablation) | Mjölnir · CIFAR100, ε=10 | PSNR_i: 21.06 -> 21.32 | Helped |
| Add the M-Adaptive Process (ablation) | Mjölnir · STL10, ε=10 | PSNR_i: 19.76 -> 19.77 | No clear effect |
| Train with perturbed gradients as a condition (ablation) | Mjölnir · MNIST, ε=10 | PSNR_i: 33.09 -> 35.14 | Helped |
| Train with perturbed gradients as a condition (ablation) | Mjölnir · CIFAR100, ε=10 | PSNR_i: 21.32 -> 23.49 | Helped |
| Train with perturbed gradients as a condition (ablation) | Mjölnir · STL10, ε=10 | PSNR_i: 19.77 -> 22.77 | Helped |
Surprising findings
- Mjölnir's diffusion-based gradient denoising remains effective even though the attacker lacks the target model and external data, relying only on a surrogate model and FashionMNIST gradients.
Limitations
- Not effective against non-noise perturbations such as representation perturbation.
- Attack success is bounded by the downstream gradient leakage attack used.
- Struggles with transformer-based models due to complex structure and parameter count.
Experimental setup
Datasets: FashionMNIST MNIST CIFAR100 STL10
Benchmarks: MNIST CIFAR100 STL10
Metrics: PSNR LRA cosine similarity inference time
Baselines: GRNN IG DLG NBNet SS-BSN AP-BSN
Builds on: DDPM DLG NbAFL
Closest papers by meaning
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.86)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.86)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.86)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.85)
- Differentially Private Stochastic Gradient Descent with Fixed-Size Minibatches: Tighter RDP Guarantees with or without Replacement (NeurIPS 2024 · similarity 0.85)
- Foreseeing Reconstruction Quality of Gradient Inversion: An Optimization Perspective (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.