픽셀값 변환 기법을 더한 데이터 복원 공격에 의한 연합학습의 프라이버시 침해
Invasion of Pivacy of Federated Learning by Data Reconstruction Attack with Technique for Converting Pixel Values
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
프라이버시 침해에 대한 안전성을 보장하기 위해 매개변수를 주고받아 학습하는 연합학습이 대두되고 있다. 하지만 최근 그래디언트를 이용하여 학습 데이터를 유출하는 논문이 발표되었다. 본 논문은 연합학습 환경에서 그래디언트를 이용하여 학습 데이터를 유출하는 실험을 구현하였으며, 학습 데이터를 유출하는 기존 공격을 개선하여 복원 성능을 높이는 방법을 제안한다. 제안 방법에 대해 Yale face database B, MNIST dataset를 이용하여 실험한 결과, 연합학습 성능이 accuracy=99~100%로 높을 때 100개의 학습 데이터 중 최대 100개의 데이터를 식별 가능한 수준으로 복원하여, 연합학습이 프라이버시 침해로부터 안전하지 않다는 것을 보인다. 또한, 픽셀 단위의 성능(MSE, PSNR, SSIM)과 Human Test에 의한 식별적인 성능을 비교함으로써 픽셀에 기반한 성능보다 식별적인 성능의 중요성을 강조하고자 한다.
Abstract
In order to ensure safety to invasion of privacy, Federated Learning(FL) that learns using parameters is emerging. However a paper that leaks training data using gradients was recently published. Our paper implements an experiment to leak training data using gradients in a federated learning environment, and proposes a method to improve reconstruction performance by improving existing attacks that leak training data. Experiments using Yale face database B, MNIST dataset on the proposed method show that federated learning is not safe from invasion of privacy by reconstructing up to 100 data out of 100 training data when performance of federated learning is high at accuracy=99~100%. In addition, by comparing the performance (MSE, PSNR, SSIM) of pixels and the performance of identification by Human Test, we want to emphasize the importance of the performance of identification rather than the performance of pixels.
참고문헌 (20)
- "Federated Learning"[URL]
- L. Zhu, "Deep leakage from gradients", Proceedings of the 33rd International Conference on Neural Information Processing Systems, pp.14774~14784 (2019)
- B. Zhao, "idlg : Improved deep leakage from gradients" (2020)
- J. Geiping, "Inverting gradients-how easy is it to break privacy in federated learning?", Proceedings of the 34th International Conference on Neural Information Processing Systems, pp.16937~16947 (2020)
- H. Yin, "See through gradients : Image batch recovery via gradinversion", Proceedings of the IEEE, 2021, 16337~16346
- Z. Li, "A survey of image gradient inversion against federated learning", TechRxiv (2022)
- 장진혁, "그래디언트 기반 재복원공격을 활용한 배치상황에서의 연합학습 프라이버시 침해연구", 정보보호학회논문지, 31(5), pp.987~999 (2021), 한국정보보호학회[DOI]
- X. Jin, "CAFE : Catastrophic data leakage in vertical federated learning", 34th Conference on Neural Information Processing Systems NeurIPS, pp.994~1006 (2021)
- W. Wei, "A framework for evaluating clinet privacy leakages in federated learning", 25th European Symposium on Research in Computer Security, LNCS, 12308, pp.545~566 (2020)
- Z. Zhang, "Generalized cross entropy loss for training deep neural networks with noisy labels", 32nd Conference on Neural Information Processing Systems (2018)
- M. Persson, "Total variation norm for three-dimensional iterative reconstruction in limited view angle tomography", Physics in Medicine & Biology, 46(3), pp.853~866 (2001)
- S. Ioffe, "Batch normalization : Accelerating deep network training by reducing internal covariate shift", International conference on machine learning. PMLR, 37, pp.448~456 (2015)
- A. Botchkarev, "Performance metrics(error measures)in machine learning regression, forecasting and prognostics : Properties and typology" (2018)
- A. Horé, "Image quality metrics : PSNR vs. SSIM", 20th international conference on pattern recognition, pp.2366~2369 (2010), IEEE
- Z. Wang, "Image quality assessment : from error visibility to structural similarity", IEEE transactions on image processing, 13(4), pp.600~612 (2004)
- A. S. Georghiades, "From few to many : Illumination cone models for face recognition under variable lighting and pose", IEEE transactions on pattern analysis and machine intelligence, 23(6), pp.643~660 (2001)
- "HE MNIST DATABASE of handwritten digits"[URL]
- "PIL"[URL]
- Y. Shi, "Communication-efficient edge AI : Algorithms and systems", IEEE Communications Surveys & Tutorials, 22(4), pp.2167~2191 (2020)
- "Federated learning: A step by step implementation in tensorflow"[URL]