论文标题
灯：用语言模型先验从渐变中提取文本
LAMP: Extracting Text from Gradients with Language Model Priors
论文作者
论文摘要
最近的工作表明，敏感用户数据可以从梯度更新中重建，从而打破了联合学习的关键隐私承诺。尽管成功主要在图像数据上证明了成功，但这些方法并未直接传输到其他域，例如文本。在这项工作中，我们提出了一种针对文本数据量身定制的新颖攻击，该攻击成功地重建了梯度的原始文本。我们的攻击基于两个关键见解：（i）使用辅助语言模型对先前的文本概率进行建模，指导搜索更自然的文本，（ii）交替进行连续和离散的优化，从而最大程度地减少了嵌入式上的重建损失，同时避免了通过应用区分文本变换来避免本地端微米。我们的实验表明，灯比先前的工作更有效：它平均重建了5倍的大型晶状体和23％的长度范围。此外，对于文本模型，我们是第一个从大于1的批次大小中恢复输入的人。这些发现表明，在文本数据上操作的模型的梯度更新比以前想象的要多。
Recent work shows that sensitive user data can be reconstructed from gradient updates, breaking the key privacy promise of federated learning. While success was demonstrated primarily on image data, these methods do not directly transfer to other domains such as text. In this work, we propose LAMP, a novel attack tailored to textual data, that successfully reconstructs original text from gradients. Our attack is based on two key insights: (i) modeling prior text probability with an auxiliary language model, guiding the search towards more natural text, and (ii) alternating continuous and discrete optimization, which minimizes reconstruction loss on embeddings, while avoiding local minima by applying discrete text transformations. Our experiments demonstrate that LAMP is significantly more effective than prior work: it reconstructs 5x more bigrams and 23% longer subsequences on average. Moreover, we are the first to recover inputs from batch sizes larger than 1 for textual models. These findings indicate that gradient updates of models operating on textual data leak more information than previously thought.
