Boosting Gradient Inversion Attacks through Adaptive Neural Architecture Search

View the PDF file from the paper entitled Gi-Nas: Enhancing the reversal attacks by searching for adaptive nervous architecture, by Wenbo Yu and 7 other authors

PDF HTML (experimental) view

a summary:Reflecting the gradual reflection attacks, the gradients sent in Federal Learning Systems (FL) to rebuild sensitive data for local customers and raised significant concerns. The majority of the methods of the gradient coup depend greatly on the previous explicit knowledge (for example, a good trained gym), which is often not available in realistic scenarios. This is because the customer data distributions in the real world are often very heterogeneous, especially in the field, and are not available to the attackers, which makes the inaccurate for attackers to obtain completely identical models that are completely identical, which inevitably suffer from basic distribution transformations for the targeted private data. To alleviate this issue, the researchers suggested taking advantage of the prior knowledge of the excessive architectural network. However, they only use a fixed nerve structure for all attack settings. This would hinder the adaptive use of the implicit architectural innocence and thus reduce the generalization. In this paper, we take advantage of such a previous implicit knowledge by proposing a gradient coup by searching for nerve architecture (GI-nas), which is looking adaptive in the network and picks up the young people who are behind the nerve structure. Intensive experiences are validated by the fact that our proposed Gi-Nas can achieve a superior attack compared to modern gradient reflection methods, even in light of the more practical settings with high-resolution images, large-sized payments, and advanced defense strategies. To the extent of our knowledge, we are the first to successfully present NAS to the reflection community. We believe that this work reveals the critical weaknesses of learning in the real world by showing the rebuilding of sensitive data for sensitive data without the need for retail devices for the field, which imposes an urgent reassessment of FL privacy guarantees.