R-GAP: Recursive Gradient Attack on Privacy
  Federated learning frameworks have been regarded as a promising approach to
break the dilemma between demands on privacy and the promise of learning from
large collections of distributed data. Many such frameworks only ask
collaborators to share their local update of a common model, i.e. gradients
with respect to locally stored data, instead of exposing their raw data to
other collaborators. However, recent optimization-based gradient attacks show
that raw data can often be accurately recovered from gradients. It has been
shown that minimizing the Euclidean distance between true gradients and those
calculated from estimated data is often effective in fully recovering private
data. However, there is a fundamental lack of theoretical understanding of how
and when gradients can lead to unique recovery of original data. Our research
fills this gap by providing a closed-form recursive procedure to recover data
from gradients in deep neural networks. We name it Recursive Gradient Attack on
Privacy (R-GAP). Experimental results demonstrate that R-GAP works as well as
or even better than optimization-based approaches at a fraction of the
computation under certain conditions. Additionally, we propose a Rank Analysis
method, which can be used to estimate the risk of gradient attacks inherent in
certain network architectures, regardless of whether an optimization-based or
closed-form-recursive attack is used. Experimental results demonstrate the
utility of the rank analysis towards improving the network's security. Source
code is available for download from https://github.com/JunyiZhu-AI/R-GAP.
