Local Differential Privacy Is Not Enough: A Sample Reconstruction Attack against Federated Learning with LDP

The researchers propose a sample reconstruction attack against federated learning (FL) with local differential privacy (LDP), which can reconstruct victims' sensitive training samples after gradients are clipped and noised, and is applicable to arbitrary target models. The core of the attack is gradient compression and reconstruction sample denoising: on one hand, an inference structure is designed based on sample features to reduce redundant gradients to cope with gradient inflation under LDP; on the other hand, zero gradients are artificially introduced to observe the noise distribution, and noise is filtered by shrinking the confidence interval. The paper provides a theoretical proof of the attack's effectiveness, and the evaluation shows that the attack has little impact on the target model's accuracy. The authors claim that this attack is currently the only attack that can reconstruct victims' training samples in LDP-based federated learning, and believe that such federated learning still requires further improvement to effectively defend against sample reconstruction.