论文标题
通过线性系统和梯度匹配分析从梯度分析训练数据泄漏
Analysing Training-Data Leakage from Gradients through Linear Systems and Gradient Matching
论文作者
论文摘要
最近的作品表明，当知道其架构时，可以从图像分类模型的梯度中重建训练图像及其标签。不幸的是，对这些梯度裂口攻击的功效和失败的理论理解仍然不完整。在本文中，我们提出了一个新颖的框架，以分析从梯度中分析训练数据泄漏，从而从基于分析和优化的梯度裂变攻击中获取见解。我们提出重建问题是从每层迭代的线性系统求解，并伴随着使用梯度匹配的校正。在此框架下，我们声称重建问题的溶解度主要取决于每层线性系统的溶解度。结果，我们能够将深层网络中培训数据的泄漏部分归因于其体系结构。我们还提出了一个指标，以衡量深度学习模型的安全水平，以防止基于梯度的攻击对培训数据的攻击。
Recent works have demonstrated that it is possible to reconstruct training images and their labels from gradients of an image-classification model when its architecture is known. Unfortunately, there is still an incomplete theoretical understanding of the efficacy and failure of these gradient-leakage attacks. In this paper, we propose a novel framework to analyse training-data leakage from gradients that draws insights from both analytic and optimisation-based gradient-leakage attacks. We formulate the reconstruction problem as solving a linear system from each layer iteratively, accompanied by corrections using gradient matching. Under this framework, we claim that the solubility of the reconstruction problem is primarily determined by that of the linear system at each layer. As a result, we are able to partially attribute the leakage of the training data in a deep network to its architecture. We also propose a metric to measure the level of security of a deep learning model against gradient-based attacks on the training data.
