Deep gradient inversion attacks expose a serious threat to Federated Learning (FL) by accurately recovering private data from shared gradients. However, the state-of-the-art heavily relies on impractical assumptions to access excessive auxiliary data, which violates the basic data partitioning principle of FL. In this paper, a novel method, Gradient Inversion Attack using Practical Image Prior (GI-PIP), is proposed under a revised threat model. GI-PIP exploits anomaly detection models to capture the underlying distribution from fewer data, while GAN-based methods consume significant more data to synthesize images. The extracted distribution is then leveraged to regulate the attack process as Anomaly Score loss. Experimental results show that GI-PIP achieves a 16.12 dB PSNR recovery using only 3.8\% data of ImageNet, while GAN-based methods necessitate over 70\%. Moreover, GI-PIP exhibits superior capability on distribution generalization compared to GAN-based methods. Our approach significantly alleviates the auxiliary data requirement on both amount and distribution in gradient inversion attacks, hence posing more substantial threat to real-world FL.

深度梯度反转攻击是联邦学习中的一种严重威胁，然而，现有的方法在访问过多的辅助数据时违反了联邦学习的基本数据分割原则。本文提出了一种新的方法，Gradient Inversion Attack using Practical Image Prior (GI-PIP)，通过修订的威胁模型进行梯度反转攻击。GI-PIP利用异常检测模型从较少的数据中捕捉潜在的分布，而基于GAN的方法需要消耗大量数据来合成图像。所提取的分布然后被应用于调节攻击过程，作为异常分数损失。实验结果表明，只使用ImageNet数据的3.8%，GI-PIP实现了16.12 dB的PSNR恢复，而基于GAN的方法则需要超过70%的数据。此外，GI-PIP在分布泛化方面表现出卓越的能力，相比基于GAN的方法。我们的方法显著减轻了对辅助数据的要求，对于梯度反转攻击来说，在数量和分布上都产生了更大的威胁于现实世界的联邦学习。

GI-PIP：梯度反转攻击是否需要不实用的辅助数据集？