The Gradient Puppeteer: Adversarial Domination in Gradient Leakage Attacks through Model Poisoning

2025-02-06

AI Summary

In federated learning, malicious servers can launch active gradient leakage attacks (AGLAs) via model poisoning; however, existing approaches suffer from incomplete coverage and poor stealth. This paper formalizes AGLA for the first time as backdoor-induced bias in the gradient space and proposes EGGV—a unified framework comprising a gradient projector, a jointly optimized discriminator, vulnerability assessment, and targeted guidance. EGGV achieves 100% attack coverage while preserving high-quality gradient reconstruction (PSNR improvement ≥43%) and significantly enhancing stealth (D-SNR improvement of 45%). Crucially, it evades client-side detection. To the best of our knowledge, EGGV is the first AGLA solution that simultaneously guarantees full coverage and high stealth, substantially outperforming state-of-the-art methods.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Large-scale security measurements

Abstract

In Federated Learning (FL), clients share gradients with a central server while keeping their data local. However, malicious servers could deliberately manipulate the models to reconstruct clients' data from shared gradients, posing significant privacy risks. Although such active gradient leakage attacks (AGLAs) have been widely studied, they suffer from several limitations including incomplete attack coverage and poor stealthiness. In this paper, we address these limitations with two core contributions. First, we introduce a new theoretical analysis approach, which uniformly models AGLAs as backdoor poisoning. This analysis approach reveals that the core principle of AGLAs is to bias the gradient space to prioritize the reconstruction of a small subset of samples while sacrificing the majority, which theoretically explains the above limitations of existing AGLAs. Second, we propose Enhanced Gradient Global Vulnerability (EGGV), the first AGLA that achieves complete attack coverage while evading client-side detection. In particular, EGGV employs a gradient projector and a jointly optimized discriminator to assess gradient vulnerability, steering the gradient space toward the point most prone to data leakage. Extensive experiments show that EGGV achieves complete attack coverage and surpasses SOTA with at least a 43% increase in reconstruction quality (PSNR) and a 45% improvement in stealthiness (D-SNR).

Problem

• Mitigating data reconstruction in federated learning
• Enhancing stealthiness and coverage in gradient leakage attacks
• Proposing a novel theoretical model for attack analysis

Innovation

• Model poisoning for gradient leakage
• Enhanced Gradient Global Vulnerability
• Gradient projector and discriminator