Skip to content
Original

CENSOR: Defending against gradient inversion attacks via orthogonal subspace Bayesian sampling

CENSOR: Defense Against Gradient Inversion via Orthogonal Subspace Bayesian Sampling

arXiv· arXiv:2501.15718· NDSS 2025· Kaiyuan Zhang, Siyuan Cheng, Guangyu Shen, Bruno Ribeiro, Shengwei An, Pin-Yu Chen, Xiangyu Zhang, Ninghui LiPurdue University; IBM ResearchIndexed by this site · 19 days ago· Originally publishedDefenses

Quick read

Defenses

Based on the paper PDF (AI-generated); refer to the original

The authors propose CENSOR, a defense against gradient inversion in federated learning that samples in a subspace orthogonal to the original gradient and selects gradients via cold posteriors; the authors claim it outperforms baselines such as Soteria on ImageNet, FFHQ, and CIFAR-10.

Threat modelThe attacker is an honest-but-curious server that knows the model architecture and the gradients uploaded by clients, cannot modify the model or gradients, and can exploit public datasets and pretrained GANs; the defender is a benign local client that does not know the attack configuration; the most favorable attack condition of batch size 1 is assumed.

Questions
Gradients uploaded by clients in federated learning can be used by gradient inversion attacks to recover private training data, and the authors believe existing defenses struggle against stronger inversion attacks and attackers with prior knowledge.
Methods
Proposes CENSOR: on the client, layer-wise project random perturbations onto a subspace orthogonal to the original gradient, normalize, then sample multiple candidate gradients and, following the cold posterior idea, select the one that reduces the local loss the most to upload.
Experiments and results
Evaluated with ResNet-18 on ImageNet, FFHQ, and CIFAR-10, the authors claim CENSOR outperforms Noise, Clipping, Sparsi, and Soteria under most attacks; for GIAS on ImageNet the MSE is 0.0650 (Table I), and accuracy after 2000 training rounds is about 86%.
Limitations and future work
The authors note that the defense is mainly deployed in the first few epochs before training; Appendix E discusses possible adaptive attacks such as using gradients to train a GAN in latent space and manipulating the temperature parameter, left for future exploration. The experiments cover only image classification, ResNet-18, and five attacks.
Experimental setupResNet-18 · ImageNet、FFHQ et al. · MSE、LPIPS et al.
Evaluated models
ResNet-18
Benchmarks
ImageNetFFHQCIFAR-10
Metrics
MSELPIPSPSNRSSIMTesting Accuracy
AI summaryThe researchers propose CENSOR, a defense method against gradient inversion attacks in federated learning, addressing the problem that local private data may be leaked when clients send back gradient updates. Gradient inversion attacks can reconstruct private training samples from a client's gradient vector, and recent advanced techniques make existing defenses difficult to counter effectively. The method targets large neural network models, exploits the high dimensionality of model parameters, perturbs gradients within a subspace orthogonal to the original gradient, and uses cold posteriors on the orthogonal subspace to implement a refined gradient update mechanism. The authors state that this allows selecting optimal gradients that both resist gradient inversion attacks and preserve model utility. Experiments compare against multiple state-of-the-art attacks and defenses on three datasets, and the code is publicly available at https://censor-gradient.github.io.

The researchers propose CENSOR, a defense method against gradient inversion attacks in federated learning, addressing the problem that local private data may be leaked when clients send back gradient updates. Gradient inversion attacks can reconstruct private training samples from a client's gradient vector, and recent advanced techniques make existing defenses difficult to counter effectively. The method targets large neural network models, exploits the high dimensionality of model parameters, perturbs gradients within a subspace orthogonal to the original gradient, and uses cold posteriors on the orthogonal subspace to implement a refined gradient update mechanism. The authors state that this allows selecting optimal gradients that both resist gradient inversion attacks and preserve model utility. Experiments compare against multiple state-of-the-art attacks and defenses on three datasets, and the code is publicly available at https://censor-gradient.github.io.

Paper analysis

6 questions; open one to read the full answer

  1. What problem does this paper attempt to solve?

    Addresses the problem in federated learning that client gradients are restored to private data by inversion attacks, while existing defenses struggle against stronger attacks.

    Core problem: gradients uploaded by federated learning clients leak private training data, and the authors believe existing defenses provide insufficient protection against stronger gradient inversion attacks.

    • Scenario and importance: in federated learning, clients send back gradients computed on local private data, from which gradient inversion attacks can reconstruct training samples; the authors claim existing defenses may fail against more effective inversion attacks or attackers with additional priors.
    • Shortcomings of existing methods: the authors claim defenses such as noise addition, gradient clipping, gradient compression, and Soteria each have weaknesses, for example clipping bounds can be estimated, sparsification masks can be reverse-engineered, and Soteria performs poorly against GAN-type attacks (Section II-C).
    • Core observations: after reproducing five attacks, the authors present two observations (Section III): most attacks succeed only in the first few epochs of training; although GGL can generate high-quality images, what it reconstructs are class-representative samples rather than the original images, so what leaks is label information.
    • Proposed approach: proposes the defense CENSOR, which samples candidate gradients in a subspace orthogonal to the original gradient and, following the cold posteriors idea, selects the gradient with the largest loss decrease to upload, balancing privacy and model utility.
    • Threat model (Section I):
      • Attacker goal: invert local training samples from gradients uploaded by clients.
      • Attacker knowledge: an honest-but-curious server that knows the model architecture and client gradients and can use public datasets and pretrained GANs.
      • Attacker capability: cannot modify the model or gradients; assumes sufficient compute and memory.
      • Victim system and setting: benign local clients unaware of the attack configuration; assumes batch size 1, which is most favorable to the attacker.

  2. What related research exists?

    Related work falls into four categories: random-optimization and GAN-type inversion attacks, existing defenses, subspace learning, and other privacy attacks and defenses.

    Gradient inversion attacks (random optimization class)

    • Zhu et al. [11] proposed Deep Leakage from Gradients, modeling the attack as iterative optimization; Zhao et al. [10] (iDLG) infer labels from gradients.
    • Geiping et al. [5] (IG) use signed gradients with Adam optimization to achieve high-resolution inversion; Yin et al. [9] (GI, GradInversion) optimize pixels from random noise for batch recovery.

    Gradient inversion attacks (GAN class)

    • Li et al. [8] (GGL) combine label inference with BigGAN/StyleGAN2 for semantic-level inversion; Jeon et al. [6] (GIAS) search in the latent space and parameter space of generative models.
    • Fang et al. [4] (GIFD), building on ILO [26], use intermediate features of a pretrained generative model with an l1 ball constraint for feature-domain optimization.

    Existing defenses

    • Noise (DP noise addition) [13], Clipping (gradient clipping) [14], Sparsi (Top-k sparsification) [15], Soteria (perturbing data representations) [16]. The paper points out: the clipping bound can be estimated by the attacker (citing experiments in [8], [4]); the sparsity of sparsification can be observed (citing [11], [8], [4]); Soteria's masking process is deterministic and can be reversed (Section II-C).

    Subspace learning and other privacy work

    • Subspace learning: Wortsman et al. [18] and others study optimization in low-dimensional subspaces of large models, providing a basis for this paper's orthogonal subspace sampling.
    • Other privacy attacks and defenses: membership inference, attribute inference, model inversion, as well as secure aggregation, homomorphic encryption, etc. (Section VI); the paper only describes them.

    Baselines and benchmarks: the comparison baselines are Noise [13], Clipping [14], Sparsi [15], Soteria [16]; the attacks are IG, GI, GGL, GIAS, GIFD; the datasets are ImageNet, FFHQ, CIFAR-10.

    The authors position this paper as: a defense that does not rely on gradient optimization and performs Bayesian sampling within an orthogonal subspace, which the authors claim therefore better resists gradient-based reconstruction attacks.

  3. How does the paper address this problem?

    On the client, CENSOR layer-wise projects random perturbations onto a subspace orthogonal to the original gradient, samples multiple candidates, and uploads the gradient selected by loss decrease.

    Overall idea: the client does not upload the true gradient; instead it samples multiple candidate perturbations in a subspace orthogonal to the original gradient and, following the cold posterior idea, selects the one that reduces the local loss the most, so that the uploaded "gradient" contains no information about the original gradient direction. Method name CENSOR (Cold postEriors coNtrolled Sampling over ORthogonal subspace).

    Theoretical Motivation: Cold Posteriors and Orthogonal Subspace

    • Cold posteriors: using the modified posterior PM(θ|D) ∝ P(D|θ)M P(θ), when the temperature parameter M approaches 0 the distribution concentrates near the MAP solution, allowing both sampling and sample quality; the meaning: use sampling instead of gradient descent to update the model.
    • Three obstacles and countermeasures: Bayesian neural networks under overparameterization sample poor solutions (mitigated by cold posteriors); the server expects to receive a gradient (the sample-select procedure produces a perturbation usable as an update); when T is large the optimal sample may approach the MAP gradient (avoided by projecting the perturbation onto an orthogonal subspace).
    • Orthogonal subspace: with m parameters and k samples, the orthogonal subspace is m−k dimensional; the authors believe that when m ≫ k the original gradient leakage is negligible.

    Three-Stage Procedure (Algorithm 1)

    1. Layer-wise orthogonal projection: for each layer's original gradient gl, sample a random gradient gr of the same shape (by default from a normal distribution N), and compute the orthogonal component glo = gr − (⟨ gr, gl ⟩)/(⟨ gl, gl ⟩) gl; the meaning: remove the component of gr along gl.
    2. Normalization: scale each layer's orthogonal gradient to the l2-norm scale of the original gradient, to avoid excessively large values.
    3. Loss-guided selection: repeat T trials (default T = 20), each time applying the candidate gradient to the model to evaluate the local loss, and keep the candidate G⋆ with the smallest loss to upload.

    Key Parameters and Design

    • Number of samples: default T = 20; the authors claim 20 trials suffice to find a good gradient (Section V-E ablation).
    • Perturbation source: normal distribution by default; gradients of real images from public datasets can also be used to mislead the attacker (Section V-E).
    • Deployment timing: based on observation 1, CENSOR is strategically enabled in the first few epochs of training (Section III).

    Success Criteria

    • Defense effectiveness is measured by the similarity between inverted images and the original images: MSE↑, LPIPS↑, PSNR↓, SSIM↓; utility is measured by test accuracy and loss under non-IID federated training (Section V-A).

  4. What experiments did the paper conduct?

    Evaluates defense effectiveness under five attacks on three datasets with ResNet-18, plus convergence, adaptive attack (EOT), and ablation experiments.

    Experimental Setup

    • Model under test: randomly initialized ResNet-18, as the federated learning initial model.
    • Datasets: ImageNet, FFHQ (10 classes, with age as the label), CIFAR-10; default batch size B = 1.
    • Attacks: IG [5], GI [9], GGL [8], GIAS [6], GIFD [4], all following the official implementations; GGL/GIFD use BigGAN on ImageNet and CIFAR-10, and StyleGAN2 on FFHQ.
    • Baseline defenses: Noise (Gaussian noise with standard deviation 0.1), Clipping, Sparsi, Soteria, with configurations following [4], [8], [6].
    • Metrics: MSE↑, LPIPS↑ (using pretrained VGG features), PSNR↓, SSIM↓; the distance measure uses negative cosine similarity.
    • Sampling and repetition: each attack is run 4 times and the run with the best inversion effect is taken; for the three datasets, 10 images are taken every 1000th image from the validation set for inversion, and the average over 10 runs is reported; no BN prior is applied.

    Main Results

    Table I: batch size 1, round 0, inversion similarity of each defense under five attacks (MSE↑ / LPIPS↑ / PSNR↓ / SSIM↓, excerpting CENSOR and the strongest baseline).

    Swipe horizontally to read the table

    DatasetAttackSoteria MSECENSOR MSESoteria LPIPSCENSOR LPIPS
    ImageNetIG0.06620.06000.75960.7551
    ImageNetGIAS0.02450.06500.49860.7591
    ImageNetGIFD0.01390.05070.39670.7610
    FFHQGGL0.04380.08230.52790.8155
    FFHQGIAS0.01140.11080.35600.7895
    CIFAR-10IG0.05580.09390.58460.6884
    CIFAR-10GIAS0.00120.07890.04610.6819

    (According to Table I; the full table includes Noise, Clipping, Sparsi and all four metrics.)

    • Authors' interpretation: the authors claim CENSOR outperforms existing defenses in almost all cases, with a maximum improvement of 114% over Soteria (authors' claim, calculated by metric); against random-optimization attacks such as IG and GI it is comparable to Soteria, and the authors say Soteria leads by 2%–18%.
    • Exceptions: under the GGL attack, on ImageNet and CIFAR-10, Clipping is about 14% higher in MSE and about 5% higher in PSNR (authors' claim); the authors speculate this is related to GGL relying on large gradient values.
    • Qualitative results: Figure 6 shows that under CENSOR each attack struggles to invert meaningful images (authors' claim).

    Larger Batch Size and Convergence

    • batch size 4: under the GIAS attack on ImageNet, CENSOR's MSE is 0.0776, LPIPS 0.7680, PSNR 11.686, SSIM 0.0099, outperforming all baselines (Table II); under GIFD the MSE is 0.0686.
    • Convergence: CIFAR-10 non-IID (simulated with a Dirichlet distribution), 100 clients, 10 selected per round, 2000 rounds; Figure 7 shows that both the original setting and CENSOR (10–50 trials) reach about 86% test accuracy after 2000 rounds, and the authors claim CENSOR does not affect convergence.
    • Different client counts: on CIFAR-10, with 10, 30, and 50 clients selected, the accuracy is 85.27, 85.33, and 85.30 respectively (Table VI).

    Adaptive Attack (EOT)

    • Setup: combining GIFD with Expectation Over Transformation, the attacker imitates CENSOR's sampling and normalization and averages gradients over multiple trials.
    • Results: on ImageNet, adding EOT changes MSE from 0.0507 to 0.0518, and on FFHQ from 0.1037 to 0.1098 (Table III); the authors claim defense performance is unaffected, because the orthogonal subspace has high dimensionality and is hard to map back to the original gradient.

    Other Ablations and Analyses

    • Number of trials T (Figure 9, ImageNet+GIAS): as T increases, the metrics improve initially and converge after exceeding 20; Figure 11 shows that at T=1 and 5 the attack can invert meaningful images, while at T=10 and 20 only noise remains.
    • Perturbation source (Figure 10, ImageNet+GGL): using a "Black grouse" image to construct the gradient, GGL is misled into inverting an image resembling a black grouse.
    • Layer-wise operation (Table VII, ImageNet+GIFD): layer-wise MSE 0.0507, whole-gradient 0.0452; the authors claim layer-wise is slightly better.
    • Training rounds (Table V, ImageNet+GIFD): from round 0 to 9, MSE rises from 0.0507 to 0.1034 and PSNR falls from 13.32 to 10.65; the authors claim inversion becomes harder the further training progresses.
    • Overhead (Appendix B): CENSOR overhead is about 0.00236%, Soteria about 0.3092%.

  5. What are some points that can be further explored?

    The authors point out that the defense focuses on early training and discuss two potential adaptive attacks; the experiments cover three image datasets, one architecture, and five attacks.

    Limitations and future directions noted by the authors

    • Limited deployment timing: Based on Observation 1, CENSOR "strategically enables [the defense] in the first few epochs of training" (Section III), i.e., the defense design targets early training.
    • GAN-class adaptive attacks: Appendix E proposes a possible attack that uses gradients to train a GAN in latent space to restore the original gradient; the authors state this is not easy under the CENSOR setting but "can be explored in the future."
    • Temperature parameter manipulation: Appendix E points out that if the attacker understands the cold posterior sampling mechanism, they may inject crafted updates to influence the posterior distribution and bias the sampling process, thereby more easily inferring the original gradient; the paper does not provide a defense.
    • The paper has no dedicated Limitations section; the above all come from Section III and Appendix E.

    Experimental coverage

    • Model tested: only one architecture, ResNet-18, randomly initialized (Section V-A).
    • Data and tasks: three image classification datasets, ImageNet, FFHQ (10 classes), CIFAR-10; default batch size 1, with batch size 4 also tested (Table II).
    • Attack coverage: five attacks, IG, GI, GGL, GIAS, GIFD; only one adaptive attack, GIFD+EOT, is tested (Table III).
    • Sample size: 10 images inverted per dataset and averaged, each attack run 4 times with the best taken (Section V-B).
    • Convergence experiment: CIFAR-10 non-IID, 100 clients, 2000 rounds (Section V-C); the paper does not report convergence experiments on other datasets.

  6. Summarize the main content of the paper

    CENSOR defends against gradient inversion by sampling in an orthogonal subspace and selecting gradients via cold posteriors; the authors claim it outperforms existing defenses and does not affect training convergence.

    A federated learning privacy defense paper (NDSS 2025), addressing the problem that client-uploaded gradients are restored to private training data by gradient inversion attacks.

    • Problem: The authors argue that existing defenses such as noise addition, clipping, sparsification, and Soteria may fail against stronger attacks or attackers with priors; after reproducing five attacks, the authors observe that most attacks are only effective in the first few epochs of training, while GGL leaks label information.
    • Method: CENSOR projects random perturbations layer by layer on the client into a subspace orthogonal to the original gradient, normalizes and then samples T = 20 candidates, and selects the gradient with the largest local loss decrease according to the cold posterior idea for upload, so that the uploaded content does not contain the original gradient direction.
    • Main results: Evaluated on ImageNet, FFHQ, CIFAR-10 with ResNet-18 and batch size 1, the authors claim CENSOR outperforms Noise, Clipping, Sparsi, Soteria on almost all attacks and metrics, e.g., against GIAS on ImageNet MSE 0.0650 versus Soteria 0.0245 (Table I); the exception is that under GGL, Clipping is slightly better on MSE and PSNR.
    • Utility: After 2000 rounds of non-IID CIFAR-10 training, accuracy is about 86%, comparable to no defense (Figure 7); overhead is about 0.00236% (Appendix B).
    • Adaptive attack: After combining GIFD with EOT, MSE on ImageNet only changes from 0.0507 to 0.0518 (Table III); the authors claim the defense is unaffected.
    • Authors' conclusion: The authors claim CENSOR outperforms existing defenses in resisting GAN-class attacks while maintaining model utility; the defense mainly targets early training, and Appendix E discusses attack surfaces left for future work such as GAN-based gradient restoration and temperature manipulation.

Related papers

Both use: FFHQ
Both use: ImageNet
Show 3 more papers
Both use: ImageNet
Read originalNDSS 2025