研究提出基于线性与仿射子空间约束的梯度反演攻击方法

攻击方法在每个 FC 层利用已知的线性子空间或仿射子空间信息来重建客户端数据。实验结果显示，子空间方法在特定设置下相比所选基线能显著提升重建质量。论文还发现，当真实批大小未知时，适度高估批大小通常能改善或保持重建质量。

研究进一步考察了差分隐私（DP）机制引入梯度扰动后的重建效果，为噪声条件下的攻击有效性提供了参考。这类工作直接关联联邦学习中梯度交换环节的数据泄露风险评估。

Gradient Inversion through Linear and Affine Subspace Constraints

Federated learning enables multiple clients to collaboratively train a machine-learning model without directly sharing their local datasets. However, as prior works have shown, the gradients exchanged during training may reveal sensitive information about client data. Most existing attacks usually optimize dummy inputs to match the true client gradients (Gradient Inversion Attacks), while some attempt to reconstruct them based on the observation that aggregate gradients from a fully connected (FC) layer are a linear combination of its inputs. In this work, we extend this observation by showing that aggregate gradients from an FC layer with the correct scaling are actually an affine combination of its inputs. We evaluate a gradient inversion attack that leverages either known linear-subspace information or its affine-subspace counterpart at each FC layer to improve reconstruction accuracy. Our results show that subspace-based methods can substantially improve reconstruction quality over the chosen baselines in certain settings. We further demonstrate that moderate overestimation of the batch size can generally improve or preserve reconstruction quality, even when the true batch size is unknown. We additionally examine reconstruction under gradient perturbations introduced by a differential privacy (DP) mechanism, providing insight into the effectiveness of the considered formulations under noisy conditions.

本条情报归属 AITOP「论文」核心追踪栏目。在跨区域产业观察坐标中，该动态直接关联「AI 开发者工具链、Coding Agent 与工程化实践」研究主线，反映出当前技术演进与商业落地的最新风向。涉及核心实体与技术议题包括：联邦学习、差分隐私、梯度反演、数据隐私，读者可通过下方标签进入对应专题页查阅历史脉络与关联对比。

信源核验说明：本文原始线索采编自「arXiv cs.LG」（@Konstantinos Bouros, Athanasios P. Liavas），经 AITOP 多维评分管线结构化提炼。