In the effort to learn from extensive collections of distributed data,
federated learning has emerged as a promising approach for preserving privacy
by using a gradient-sharing mechanism instead of exchanging raw data. However,
recent studies show that private training data can be leaked through many
gradient attacks. While previous analytical-based attacks have successfully
reconstructed input data from fully connected layers, their effectiveness
diminishes when applied to convolutional layers. This paper introduces an
advanced data leakage method to efficiently exploit convolutional layers'
gradients. We present a surprising finding: even with non-fully invertible
activation functions, such as ReLU, we can analytically reconstruct training
samples from the gradients. To the best of our knowledge, this is the first
analytical approach that successfully reconstructs convolutional layer inputs
directly from the gradients, bypassing the need to reconstruct layers' outputs.
Prior research has mainly concentrated on the weight constraints of convolution
layers, overlooking the significance of gradient constraints. Our findings
demonstrate that existing analytical methods used to estimate the risk of
gradient attacks lack accuracy. In some layers, attacks can be launched with
less than 5% of the reported constraints.

该研究论文介绍了一种高级数据泄漏方法，可以高效地利用卷积层的梯度，证明了现有用于估计梯度攻击风险的分析方法缺乏准确性。