Diffusion models are becoming defector generative models, which generate exceptionally high-resolution image data. Training effective diffusion models require massive real data, which is privately owned by distributed parties. Each data party can collaboratively train diffusion models in a federated learning manner by sharing gradients instead of the raw data. In this paper, we study the privacy leakage risk of gradient inversion attacks. First, we design a two-phase fusion optimization, GIDM, to leverage the well-trained generative model itself as prior knowledge to constrain the inversion search (latent) space, followed by pixel-wise fine-tuning. GIDM is shown to be able to reconstruct images almost identical to the original ones. Considering a more privacy-preserving training scenario, we then argue that locally initialized private training noise $\epsilon$ and sampling step t may raise additional challenges for the inversion attack. To solve this, we propose a triple-optimization GIDM+ that coordinates the optimization of the unknown data, $\epsilon$ and $t$. Our extensive evaluation results demonstrate the vulnerability of sharing gradient for data protection of diffusion models, even high-resolution images can be reconstructed with high quality.

我们研究了扩散模型在生成高分辨率图像数据方面的应用，使用基于梯度的协作训练方法，我们设计了一种融合优化模型（GIDM），以减小梯度反演攻击的风险，并进一步提出了三重优化模型（GIDM+）来解决隐私保护方面的挑战。通过广泛的评估结果，我们发现共享梯度对于扩散模型的数据保护存在漏洞，即使是高分辨率图像也可以被高质量地重建。

联邦扩散模型的梯度反演