标题： 代理模型扩展（SME）：一种针对联邦学习的快速且准确的权重更新攻击 显示英文标题

标题： Surrogate Model Extension (SME): A Fast and Accurate Weight Update Attack on Federated Learning

摘要： 在联邦学习（FL）和许多其他分布式训练框架中，合作者可以在本地保存其私有数据，并在多次迭代后仅共享使用本地数据训练的网络权重。 梯度反转是一类隐私攻击，可以从生成的梯度中恢复数据。 表面上看，FL可以提供一定程度的保护，以防止对权重更新的梯度反转攻击，因为单步的梯度被多个本地迭代的梯度累积所隐藏。 在本工作中，我们提出了一种系统的方法，将梯度反转攻击扩展到FL中的权重更新，从而更好地暴露FL中固有的隐私保护的弱点。 具体来说，我们提出了一种基于二维梯度流特性和局部更新低秩性质的代理模型方法。 我们的方法大大增强了对包含许多迭代的权重更新的梯度反转攻击能力，并实现了最先进的（SOTA）性能。 此外，在常见的FL场景中，我们的方法比SOTA基线快多达$100\times$倍。 我们的工作重新评估并突显了共享网络权重的隐私风险。 我们的代码可在 https://github.com/JunyiZhu-AI/surrogate_model_extension 获取。 显示英文摘要

摘要： In Federated Learning (FL) and many other distributed training frameworks, collaborators can hold their private data locally and only share the network weights trained with the local data after multiple iterations. Gradient inversion is a family of privacy attacks that recovers data from its generated gradients. Seemingly, FL can provide a degree of protection against gradient inversion attacks on weight updates, since the gradient of a single step is concealed by the accumulation of gradients over multiple local iterations. In this work, we propose a principled way to extend gradient inversion attacks to weight updates in FL, thereby better exposing weaknesses in the presumed privacy protection inherent in FL. In particular, we propose a surrogate model method based on the characteristic of two-dimensional gradient flow and low-rank property of local updates. Our method largely boosts the ability of gradient inversion attacks on weight updates containing many iterations and achieves state-of-the-art (SOTA) performance. Additionally, our method runs up to $100\times$ faster than the SOTA baseline in the common FL scenario. Our work re-evaluates and highlights the privacy risk of sharing network weights. Our code is available at https://github.com/JunyiZhu-AI/surrogate_model_extension.