Federated learning enables the training of machine learning models on
distributed data without compromising user privacy, as data remains on personal
devices and only model updates, such as gradients, are shared with a central
coordinator. However, recent research has shown that the central entity can
perfectly reconstruct private data from shared model updates by maliciously
initializing the model's parameters. In this paper, we propose QBI, a novel
bias initialization method that significantly enhances reconstruction
capabilities. This is accomplished by directly solving for bias values yielding
sparse activation patterns. Further, we propose PAIRS, an algorithm that builds
on QBI. PAIRS can be deployed when a separate dataset from the target domain is
available to further increase the percentage of data that can be fully
recovered. Measured by the percentage of samples that can be perfectly
reconstructed from batches of various sizes, our approach achieves significant
improvements over previous methods with gains of up to 50% on ImageNet and up
to 60% on the IMDB sentiment analysis text dataset. Furthermore, we establish
theoretical limits for attacks leveraging stochastic gradient sparsity,
providing a foundation for understanding the fundamental constraints of these
attacks. We empirically assess these limits using synthetic datasets. Finally,
we propose and evaluate AGGP, a defensive framework designed to prevent
gradient sparsity attacks, contributing to the development of more secure and
private federated learning systems.

基于联邦学习的隐私保护中，我们提出了 QBI 和 PAIRS 两个算法，分别通过稀疏激活模式和附加数据集的方式提高了恢复数据的能力，并且在 ImageNet 和 IMDB 情感分析数据集上得到了显著的改进，同时我们还提出并评估了 AGGP，用于防止梯度稀疏攻击，为更安全和私密的联邦学习系统的开发做出了贡献。