RGLA: Reverse Gradient Leakage Attack using Inverted Cross-Entropy Loss Function

I hope the reviewer doesn't mind me intervening. I think to relax the known label assumption, the authors can combine their work with one of the following:
[1] Aidmar Wainakh, Fabrizio G. Ventola, Till Mußig, Jens Keim, Carlos Garcia Cordero, Ephraim Zimmer, Tim Grube, Kristian Kersting, and M. Muhlh ¨ auser. User-level label leakage from gradients in federated learning. Proceedings on Privacy Enhancing Technologies, 2022:227 – 244, 2021
[2] Geng, Jiahui, et al. "Towards general deep leakage in federated learning." arXiv preprint arXiv:2110.09074 (2021).
( I have a somewhat working implementation in https://github.com/eth-sri/fedavg_leakage/blob/0edb1b948a9003c88b2f74d9105c68e22e90cc47/fedavg/utils/flax_losses.py#L339 but you can use your auxiliary data to fit it better.)
[3] Kailang Ma, Yu Sun, Jian Cui, Dawei Li, Zhenyu Guan, and Jianwei Liu. 2023. Instance-wise batch label restoration via gradients in federated learning. In International Conference on Learning Representations

Thank you for your thorough review and valuable suggestions and questions on our manuscript. We sincerely accept your opinions and will make revisions and improvements. Note that the order of some figures/results has changed with the rebuttal revision. The implementation of the additional experiment can be found in our updated github repository and updated supplementary material. Below, we address specific points you raised.

Q1 The lack of sufficient evidence supporting some claims, such as "the first to successfully disaggregate the feature map in a generic federated learning setting," and the omission of key reference [1] and one comparison with [4] removing the loss on BN statistics.

Thank you for bringing the works [1, 4] to our attention. We would like to emphasize that there are differences between them and our paper in terms of methods and results, and we have removed this statement in the revision. For [1], the Cocktail Party Attack (CPA) treats the problem of gradient inversion as a Blind Source Separation (BSS) issue, based on the premise that the gradients of a Fully Connected (FC) layer can be seen as a linear combination of its inputs. CPA then uses Independent Component Analysis (ICA) to address the BSS problem. In contrast, our method initially leaks the model's output and then further leaks the feature map. This strategy allows all methods that invert model inputs based on model outputs to be applicable in the context of gradient leakage attacks, thereby significantly increasing the vulnerability of gradients. We discuss this paper in the related works section of our rebuttal version.

Since there is no official source code for the previous work [4] (STG), we perform the STG using the STG source code published by FGLA [8], which we also included in our open-source code. We compared our method with STG (with or without BN statistics) using the ImageNet dataset (224$\times$224) and batch size of 8, and the results are shown in Table 1. It is clear from Table 1 that our method outperforms prior work [4] in terms of time efficiency and reconstruction results.

Table 1

Q2 1. Assumption of ground-truth labels: the attack needs access to ground truth labels, which differs from many competing methods, and queries how $\mathcal{A}$ could feasibly retrieve these labels from gradients. 2. Omission of multiple updates scenario in FL: the proposed method doesn't address the characteristic feature of multiple updates in FL. 3. Attack's dependence on an external dataset. 4. Limitation to classification tasks of B<=C. In the same spirit when writing as defense increasing the batch-size it is more a limitation of the attack than a true defense deserving its own section. 5. Code repository has a bug. 6. Lack of experiments on varying resolution images.

1. We would like to clarify that the assumption of ground-truth labels is reasonable for the reason. This label assumption shared in recent studies [7-10], which either assume that the adversary knows the labels [7, 8], or first extract the labels [9, 10, 11] using existing label inference techniques.

   To improve rigor, we combine our method with a stat-of-the-art label inference technique, iLRG [6]. Table 2 shows the average results of data reconstruction on 100 batches. Notably, iLRG achieved a 100% accuracy rate in our experiments, though the order of the reconstructed labels differs from that of the actual ground-truth labels. As shown in Table 2, the reconstructed results obtained using ground-truth labels and those reconstructed results using the iLRG [6] are similar. Fig. 11 in our rebuttal version provides visual reconstruction results, illustrating that both ground-truth labels and inferred labels can successfully reconstruct visual outcomes, except that using inferred labels causes the reconstructed data to be in a different order from the original data. We also add this experiment and corresponding discussion in the Appendix of our rebuttal version.

   	PSNR$\uparrow$	SSIM$\uparrow$	LPIPS$\downarrow$
   Ground-truth label + RGLA(Ours)	19.24153	0.50947	0.55870
   iLRG[6]+ RGLA(Ours)	19.22677	0.49973	0.56795

   Table 2

Thanks you for your suggestion, we combine the label inference technique of [3] with our method to relax the label assumption and the experiment results can be seen in our rebuttal version.

Response to Q2: Can the authors comment on their attack's compatibility with FedAvg? Can they experiment with attacking the FedAvg setting? In particular, here [1] will be useful, as it might be easy to combinable with the author's method.
[1] Zhu, Junyi, Ruicong Yao, and Matthew B. Blaschko. "Surrogate model extension (SME): A fast and accurate weight update attack on federated learning." arXiv preprint arXiv:2306.00127 (2023).

Q10 The authors are misrepresenting their findings (I take the current answer to question 5 as one of the many examples of misrepresenting results: "We have tested our code on different machines, but do not encounter your mentioned error. Could you provide detailed error information? We will do our best to help you solve it." while the fact that the function's code on the README is blatantly misleading is difficult to refute) and thus it makes it hard to form an accurate picture of the contribution as the findings of the rebuttal would need to be reviewed with more care.

Sorry, we thought your concern was about a bug in our code. Thank you for pointing this out, and in order to make our contribution clearer, we've improved the README file in our code, which hopefully addresses your concern!

Q11 Notably the addition of experiments on GradInv brings more questions than it answers.

We are seeking clarification regarding your statement, "Notably the addition of experiments on GradInv [4] brings more questions than it answers." Are you suggesting that there is an issue with our implementation of GradInv [4]? Considering that GradInv [4] does not have an official open-source code, we adopted the implementation of GradInv [4] as used in FGLA, who compared it in their work. We believe their implementation can be considered reliable. Alternatively, you may run the code we have provided in the supplementary materials for further verification.

Q12 The authors also disregarded in the paper the two most related works GradInv and BSS in the literature, which, considering the rest of the paper, is interpreted by the reviewer as not completely genuine.

We have discussed both GradInv [4] and BSS [7] in the related work section of our manuscript and have accordingly adjusted the rest of the paper.

Q13 A minima, the reviewer would like to see the authors' paper rewritten more clearly by either 1. potentially redoing all experiments with iLRG and dropping the known labels assumption 2. stating the assumption in a less confusing manner in the text and in the code not to misrepresent the contribution. Cleaning the text from the abundance of overstatements and misleading statements.

Thank you for your time and effort in providing such detailed and important feedback. We believe our assumption about labels is reasonable, and below, we explain why this assumption is reasonable.

1. Firstly, existing techniques for inferring labels are quite mature and can reconstruct true labels with high accuracy, up to 100%. Therefore, we assume adversaries can obtain true labels, allowing us to focus our limited paper space on the theft of private data, which is likely the primary concern for adversaries.

2. Second, we have had in-depth discussions on this issue with researchers in the field. Indeed, most of the notable work [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] in our research area is based on a common assumption - that labels are accessible. This general consensus supports our approach and allows us to focus our main efforts on the core problem of data theft.

3. Lastly, our experiments on the ImageNet dataset and the ResNet50 model show that when the batch size is less than 256, iLRG[11] achieves 100% accuracy in label reconstruction (also as evident from Figure 3 in [11]). This indicates that adversaries can easily obtain true labels. Furthermore, all the state-of-the-art methods compared in our paper also used ground-truth labels, making our experimental comparisons fair.

Considering these points, the assumption that adversaries can access ground-truth labels is reasonable.

We have adjusted our manuscript to state assumptions and contributions more clearly. Please refer to the latest rebuttal version for these changes.

Q9 Computing the probability from which the authors find the formula for B=256 or the target batch size would lead to a either low or high frequency of duplicate labels. This was the reasoning behind the comment of the reviewer. Knowing whether or not one is expected to encounter many duplicate labels is important.

The ImageNet dataset has a total of 1000 classes, and assuming a batch size of $B$, the probability of the existence of a duplicate label is:

$p=1-(\frac{1000}{1000}\times\frac{999}{1000}\times\frac{998}{1000}...\times\frac{1000-B+1}{1000})$.

Therefore, when the batch size is set to 256, the probability of encountering duplicate labels is 0.99999. We have also created a graph illustrating how the probability $$p$$ varies with the batch size $$B$$. You can find this graph in the supplementary materials under the filename "DuplicateLabelProbability.png".

Also, if you are interested in seeing the performance of our proposed method under different proportions of duplicate labels within a batch, please refer to Section 5.1 of our manuscript.

Q8 Regarding 5. to illustrate more explicitly the problem, the current code in the README reads: def Model_output_leakage(grad, model): This gives the false impression that it does not need labels, that are accessed here wo being defined in the function: pred_modelloss = pred_loss(grad, label, batchsize, defence_method) Label is declared globally which is a bad code practice in addition the correct signature should read: def Model_output_leakage(grad, model, labels): This example is representative of the rest of the paper.

Thank you for pointing this out, we have improved the function declarations in the README file in our code. The introduction, threat model, method, and experiment section of our manuscript explicitly state that our approach requires the ground-truth label, an assumption also shared with many well-known works [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] in this research field.

[1] Zhu J, Blaschko M. R-gap: Recursive gradient attack on privacy[J]. arXiv preprint arXiv:2010.07733, 2020.

[2] Jonas Geiping, Hartmut Bauermeister, Hannah Droge, and Michael Moeller. Inverting gradients - ¨how easy is it to break privacy in federated learning? ArXiv, abs/2003.14053, 2020.

[3] Hongxu Yin, Pavlo Molchanov, Jose M. Alvarez, Zhizhong Li, Arun Mallya, Derek Hoiem, Niraj K Jha, and Jan Kautz. Dreaming to distill: Data-free knowledge transfer via DeepInversion. In CVPR, 2020. 2, 5, 6.

[4] Yin, Hongxu, et al. "See through gradients: Image batch recovery via gradinversion." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2021.

[5] Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior. In Neural Information Processing Systems, pp. 29898–29908, 2021.

[6] Yang H, Ge M, Xiang K, et al. Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks[J]. IEEE Transactions on Information Forensics and Security, 2022, 18: 818-830.

[7] Kariyappa, Sanjay, et al. "Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis." International Conference on Machine Learning. PMLR, 2023.

[8] Dongyun Xue, Haomiao Yang, Mengyu Ge, Jingwei Li, Guowen Xu, and Hongwei Li. Fast generation-based gradient leakage attacks against highly compressed gradients. IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, 2023.

[9] Yue K, Jin R, Wong C W, et al. Gradient obfuscation gives a false sense of security in federated learning[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 6381-6398.

[10] Zhu J, Yao R, Blaschko M B. Surrogate model extension (SME): A fast and accurate weight update attack on federated learning[J]. arXiv preprint arXiv:2306.00127, 2023.

While the reviewer appreciate the dedication of the authors during the rebuttal process and the thorough answers. The reviewer stand with their initial scoring.

The authors are misrepresenting their findings (I take the current answer to question 5 as one of the many examples of misrepresenting results: "We have tested our code on different machines, but do not encounter your mentioned error. Could you provide detailed error information? We will do our best to help you solve it." while the fact that the function's code on the README is blatantly misleading is difficult to refute) and thus it makes it hard to form an accurate picture of the contribution as the findings of the rebuttal would need to be reviewed with more care. Notably the addition of experiments on GradInv brings more questions than it answers. The authors also disregarded in the paper the two most related works GradInv and BSS in the literature, which, considering the rest of the paper, is interpreted by the reviewer as not completely genuine.

A minima, the reviewer would like to see the authors' paper rewritten more clearly by either 1. potentially redoing all experiments with iLRG and dropping the known labels assumption 2. stating the assumption in a less confusing manner in the text and in the code not to misrepresent the contribution. Cleaning the text from the abundance of overstatements and misleading statements.

The reviewer also disagrees with the assessment from reviewer p8x8.

Reference:

[1] Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok. Gradient inversion with generative image prior. In Neural Information Processing Systems, pp. 29898–29908, 2021.

[2] Dongyun Xue, Haomiao Yang, Mengyu Ge, Jingwei Li, Guowen Xu, and Hongwei Li. Fast generation-based gradient leakage attacks against highly compressed gradients. IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, 2023.

[3] Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu. Auditing privacy defenses in federated learning via generative gradient leakage. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 10132–10142, 2022.

[4] Yang H, Ge M, Xiang K, et al. Using Highly Compressed Gradients in Federated Learning for Data Reconstruction Attacks[J]. IEEE Transactions on Information Forensics and Security, 2022, 18: 818-830.

[5] Hanchi Ren, Jingjing Deng, and Xianghua Xie. Grnn: generative regression neural network—a data leakage attack for federated learning. ACM Transactions on Intelligent Systems and Technology (TIST), 13(4):1–24, 2022.

[6] Yue K, Jin R, Wong C W, et al. Gradient obfuscation gives a false sense of security in federated learning[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 6381-6398.

[7] Wainakh A, Ventola F, Müßig T, et al. User-level label leakage from gradients in federated learning[J]. arXiv preprint arXiv:2105.09369, 2021.

[8] Ma K, Sun Y, Cui J, et al. Instance-wise Batch Label Restoration via Gradients in Federated Learning[C]//The Eleventh International Conference on Learning Representations. 2022.

[9] Zhu J, Blaschko M. R-gap: Recursive gradient attack on privacy[J]. arXiv preprint arXiv:2010.07733, 2020.

[10] Jonas Geiping, Hartmut Bauermeister, Hannah Droge, and Michael Moeller. Inverting gradients - ¨how easy is it to break privacy in federated learning? ArXiv, abs/2003.14053, 2020.

[11] Wu, Ruihan, et al. "Learning to invert: Simple adaptive attacks for gradient inversion in federated learning." Uncertainty in Artificial Intelligence. PMLR, 2023.

[12] Kariyappa, Sanjay, et al. "Cocktail party attack: Breaking aggregation-based privacy in federated learning using independent component analysis." International Conference on Machine Learning. PMLR, 2023.

[13] Sun, Jingwei, et al. "Soteria: Provable defense against privacy leakage in federated learning from representation perspective." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.

[14] Scheliga, Daniel, Patrick Mäder, and Marco Seeland. "Precode-a generic model extension to prevent deep gradient leakage." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2022.

Thank you for your thorough review and valuable suggestion and question on our manuscript. We sincerely accept your opinions and will make revisions and improvements. Note that the order of some figures/results has changed with the rebuttal revision. The implement of the additional experiment can be find in our updated github repository and updated supplementary material. Below, we address specific points you raised.

Q1 1. Assumption of auxiliary datasets 2. Assumption of ground-truth labels. 3. Requirement on the target network to have no pooling layer. 4. Requirement on B to not exceed C+1.

1. Accessing an auxiliary dataset: many of the more recent works [1, 2, 3, 4, 5, 6] in our research field require access to an external dataset. Moreover, we believe that in a real federated learning scenario, an adversary can use some open-source datasets as auxiliary data to facilitate the attack, which is not a difficult thing.

2. Access to ground-truth labels. We would like to clarify that the assumption of ground-truth labels is reasonable for this reason. This label assumption shared in recent studies [1, 2, 4, 9, 10], which either assume that the adversary knows the labels [1, 2], or first extract the labels [4, 9, 10] using existing label inference techniques.

   To improve rigor, we combine our method with a state-of-the-art label inference technique, iLRG [8]. Table 1 shows the average results of data reconstruction on 100 batches. Notably, iLRG achieved a 100% accuracy rate in our experiments, though the order of the reconstructed labels differs from that of the actual ground-truth labels. As shown in Table 1, the reconstructed results obtained using ground-truth labels and those reconstructed results using the iLRG [8] are similar. Fig. 11 in our rebuttal version provides visual reconstruction results, illustrating that both ground-truth labels and inferred labels can successfully reconstruct visual outcomes, except that using inferred labels causes the reconstructed data to be in a different order from the original data. We also add this experiment and corresponding discussion in the Appendix of our rebuttal version.

   	PSNR$\uparrow$	SSIM$\uparrow$	LPIPS$\downarrow$
   Ground-truth label + RGLA(Ours)	19.24153	0.50947	0.55870
   iLRG [8] + RGLA(Ours)	19.22677	0.49973	0.56795

   Table 1

3. The target network to have no pooling layer: Indeed, we removed the average pooling layer over the fully-connected layer (FC layer) in our experiments in order to make the feature map larger so that it contains more information about the original data, which is consistent with what was done in [2]. In order to explore how much information is lost by the average pooling layer, we conducted experiments in two scenarios: one in which the pooling layer is removed and the other in which the pooling layer is retained. And keep the rest of the experimental settings the same, including a batch size of 8, a dataset of ImageNet, and attacking the same 100 data batches. According to the experimental results in Table 2, whether the pooling layer is removed or not, our proposed method is able to reconstruct model outputs that are very close to the actual model outputs, which further reconstructs feature maps that are similar to the original feature maps. However, in the setting with the pool layer, the generator can not generate the original data even with the precise feature map. This phenomenon can be attributed to the fact that the addition of the pooling layer reduces the information about the original data contained in the feature maps, making it difficult for the generator to reconstruct the original image from feature maps that contain less information about the original data. The contribution of our manuscript does not lie in the training of the generator, which is the main contribution of [1]. In the future, we also expect more powerful generator models to be able to reconstruct the original images from corresponding feature maps even with limited information contained.

Q1 Can the authors provide more information about the experiment in Table 1? In particular, what was the batch size and number of repeated class labels?

The experiments setup for Table 1 consists of the attacked dataset: cifar100, the attacked network: resnet50, the batch size: 8, and the labels distribution of is assigned randomly. We think you want to see how the combination of iLRG and RGLA performs with repeated labels, so we added the experiment in the case of 4 repeated labels and a batch size of 8, and merged the results with Table 1, as shown in Table 5. From Table 5 we can see that repeated labels have no effect on the combination of iLRG with RGLA, which further validates the reasonableness of label assumptions.

Table 5

[1] Ma K, Sun Y, Cui J, et al. Instance-wise Batch Label Restoration via Gradients in Federated Learning[C]//The Eleventh International Conference on Learning Representations. 2022.

Q2 Can the authors explore the connection between their auxiliary dataset and the one that they attack more thoroughly? That is, can they show how different level of data shifts will affect their results?

Our auxiliary dataset is ImageNet and experiments have been performed on ImageNet, CelebA, Cifar10, and Cifar100, our intuition is that the similarity of the auxiliary dataset to the attacked dataset as well as the complexity of the auxiliary dataset to the attacked dataset affect the results.

• Similarity between the auxiliary dataset and the attacked dataset affect the result. The similarity between ImageNet and the Cifar100 dataset is greater than that between ImageNet and the CelebA dataset, and from the experiment results on the right of Fig. 2 in the manuscript we can see that the reconstruction results on the cifar100 dataset are better than those on CelebA. Therefore we draw this conclusion the more similar the auxiliary dataset and the attacked dataset are the more favourable to the attack. However, there is no good way to quantify this similarity between the two datasets, so for the time being, we do not have a good way to quantitatively state how much the difference between the auxiliary dataset and the attacked dataset affects the results. However, we feel that the attacker can adjust the auxiliary dataset when performing reconstruction attacks. For example, if the attacker originally used ImageNet to attack CelebA, and when the reconstructed result can be visually seen as a human face, but may not be clearly identifiable, we can connect some face images to feed into the generator before performing the attack, and the result may become better. In other words, we can adjust the auxiliary dataset of our generator according to the reconstructed result.
• The complexity of the auxiliary dataset being greater than that of the attacked dataset is advantageous for attacks. For instance, using ImageNet as an auxiliary dataset to attack Cifar100 allows the generator to learn more complex details, which is beneficial for the attack.

Q1: Thank you for this. I believe including an even larger level of label duplication - e.g something like batch size 64 with several sets of repeated labels will be better suited for the final manuscript. That said, I am really grateful for the provided extended results.

Q2: I think it will be nice if the authors include this discussion somewhere in their appendix in the next revision.

Thank you very much for your praise on our manuscripts, such as "innovative attacks", "insightful design", "solid theoretical analyses", "extensive and thorough experiments", "well-written", and so on. We are honored to receive such praise and we do our best to address your concerns and questions.

Q1 1. There is a lack of detailed information on the training of the generator used for mapping final feature maps to original input samples and clarity on the effort required to train this generator. 2. How the generator's performance is influenced by the increasing accuracy of the victim model.

Thank you very much for your question.

1. The structure of the generator and its training details have been thoroughly described in the prior work [1]. Here, I would like to add some details that were not mentioned in [1]: the generator has a total of 100,590,979 parameters, and consumes about 23GB of video memory when the batch size is 32 during training. When experimenting on ImageNet, it takes about 2 hours to complete an epoch, and typically after about 4 epochs of training, the generator is able to effectively invert the feature map back to the original model input. This generator training does not affect the efficiency of our attacks. This is because it is becoming increasingly common to use a pre-trained convolutional layer plus an untrained fully-connected layer and to fix the convolutional layer to train only the fully-connected layer during the training process. In this case, we only need to train one generator to attack the private data of multiple clients in multiple rounds of federated learning.

2. As the accuracy of the attacked model increases, the feature map will contain more information about the original data, potentially reducing the time required to train an efficient generator.

Q4 It appears that the reconstructed samples exhibit a degree of over-smoothing, lacking sharp edges and finer details. This effect seems reminiscent of applying a large Total Variation loss or L2 loss. Could you please explain the reasons behind this observation? Is it related to the characteristics of the feature inversion generator? Are there potential room for improvement? If the level of smoothness can be adjusted, what will the results look like if they do not appear so smooth?

Thank you for your question! Regarding the excessive smoothing that occurs in the reconstructed samples, as well as the lack of sharp edges and fine details, this may indeed be related to the Total Variation loss or L2 loss that we used. In addition to this, we believe it is also related to the architectural characteristics of our generator. Our generator employs a multi-layer convolutional and deconvolutional network, complemented by LeakyReLU activation functions and batch normalization (BatchNorm). This design helps produce smoother images and mitigating overfitting to some extent. However, it might also lead to the loss of high-frequency details in images. During the training of the generator, we used Mean Squared Error Loss (MSELoss) along with image quality metrics such as PSNR, SSIM, and LPIPS. The combination of these loss functions might further enhance the smoothing effect, particularly as PSNR and SSIM tend to assess overall structural similarity rather than precise detail reproduction. Regarding improvements to reduce image over-smoothing, we believe that adjustments to the loss function, optimization of the generator’s network structure, or the incorporation of techniques specifically aimed at high-frequency detail restoration could yield enhancements. For instance, exploring more complex loss functions like Perceptual Loss or losses used in Generative Adversarial Networks (GANs) might encourage the generation of more detailed and textured images. However, due to time constraints during the rebuttal phase, we were unable to explore more optimization functions and more robust generator models. We hope the reviewers can understand us.

Q5 See weakness 2, I am curious about the performance of the proposed approach when using the average pooling layer before the final FC layer.

See our answer to Q2.

Reference:

[1] Dongyun Xue, Haomiao Yang, Mengyu Ge, Jingwei Li, Guowen Xu, and Hongwei Li. Fast generation-based gradient leakage attacks against highly compressed gradients. IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, 2023.

Q2 A small weakness: I notice in the code provided in supplementary materials, the authors made some change to the architecture of Resnet - They remove the average pooling layer (over a 7x7 feature map), thus by stretching the final feature map, the FC layer is indeed 49 times wider than before. This inevitably simplifies the difficulty of reconstructions a lot. To me this is not a severe concern, since the major part of paper does not assume how feature maps are reshaped to enter the FC layers, and this technical modification is not the focus of the research problem. But for the researchers studying this problem, they could be concerned about this. I wonder could authors show how the results will be like, if not removing average pooling, and use the original Resnet architecture in Torchvision implementation? It is expected to see performance drop in that case, but revealing this could give readers more insights about the difficulty of the problem, and understand how much information will be lost by average pooling before FC layer.

Thank you for meticulously reviewing our code and providing valuable comments. Indeed, we removed the average pooling layer over the fully-connected layer (FC layer) in our experiments in order to make the feature map larger so that it contains more information about the original data, which is consistent with what was done in [1]. In order to explore how much information is lost by the average pooling layer, we conducted experiments in two scenarios: one in which the pooling layer is removed and the other in which the pooling layer is retained. And keep the rest of the experimental settings the same, including a batch size of 8, a dataset of ImageNet, and attacking the same 100 data batches. According to the experimental results in Table 1, whether the pooling layer is removed or not, our proposed method is able to reconstruct model outputs that are very close to the actual model outputs, which further reconstructs feature maps that are similar to the original feature maps. However, in the setting with the pool layer, the generator can not generate the original data even with the precise feature map. This phenomenon can be attributed to the fact that the addition of the pooling layer reduces the information about the original data contained in the feature maps, making it difficult for the generator to reconstruct the original image from feature maps that contain less information about the original data. The contribution of our manuscript does not lie in the training of the generator, which is the main contribution of [1]. In the future, we also expect more powerful generator models to be able to reconstruct the original images from corresponding feature maps even with limited information contained.

Table 1: The $\hat{y}$ is the actual model output, the $\hat{y}^{\prime}$ is the optimized model output, the $f$ is the actual feature map, and the $f^{\prime}$ is the obtained feature map.

I think this covers the list, yes. That said, works like [1,2] show that simple decoders directly on the gradients work ( I appreciate the setup here is slightly different but still ), so I am leaning towards point 1. I appreciate that the authors are busy with the rest of the rebuttal, so I won't be bothering them on this anymore, but maybe consider training a diffusion model after the deadline. Might be able to tell us to what extent the problem is based on 2 or 3.

[1] https://openreview.net/forum?id=Gt_GiNkBhu&referrer=%5Bthe%20profile%20of%20Chuan%20Guo%5D(%2Fprofile%3Fid%3D~Chuan_Guo1)
[2] https://arxiv.org/abs/2306.03013

It is a great honor to receive your attention on our manuscript. These comments you raise are quite professional and will improve the quality of our paper. Here are our answers to your questions:

The proof of Proposition 2 in Appendix A.2. is a bit unclear around Eq. 14. In particular, I am not sure what are $i$,$j$,$k$, and $t$ there.

In equation (14), $i$ and $k$ denote the indexes of the samples within the input batch; $j$ and $t$ denote the indexes of the class. We have added the above explanation near equation (14) in the rebuttal version.

In Table 5, in Appendix A.3, what is the L2 loss referring to? The final image reconstruction loss, $\mathcal{L}_{textloss}$, or something else?

In Table 5, the L2 loss refers to the squared difference between the actual model's cross-entropy loss and the estimated model's cross-entropy loss, which is our loss term $\mathcal{L}_{loss}$

In [1], a ResNet with removed pooling layers is used as the attacked network. Do the authors assume the same setup? If so, can the authors clearly state in Section 3?

Yes, we have made the same assumption about removing the pooling layers as in [1], and we have clearly stated this in our manuscript.

In Appendix A.3, the authors say: “...our attack primarily occurs during the initialization or pre-training phase of the model training...”. It would be nice if this limitation is also explicitly stated in Section 3.

We appreciate your suggestion and have added this point in Section 3 of our rebuttal version.

On page 6 top, the authors suggest that the twin solutions come from the overdetermined system. I do not think this is correct. Instead, in [2], it is shown the reason is that the equation is non-linear ( due to $\frac{\partial l}{\partial\hat{y}^\prime}$ being non-linear ). I think this is the reason here, as well.

Thank you for pointing out this claim. The reason for the existence of twin solutions is indeed the non-linearity of $\frac{\partial l}{\partial\hat{y}^\prime}$, and we realized this after submitting our manuscripts. We have corrected this in our rebuttal version.

FGLA [1] is advertised as a highly effective attack against compressed gradients. [1] claims that FGLA can handle 99.2% of the gradients being compressed. Do I understand correctly that the proposed method improves on this by allowing reconstruction from 99.9% of the gradients? Can you provide in the appendix a full comparison between the two methods on different levels of gradient compression?

Yes, our proposed method improves on this by allowing reconstruction from 99.9% of the gradients. We have provided a comprehensive comparison between FGLA [1] and RGLA under different levels of gradient compression in the appendix of our rebuttal version.

In Section 5.3 you cite the wrong paper for the choice of $\mathcal{C}=4$. Should be [3]

We've corrected this reference in the rebuttal version.

[1] Dongyun Xue, Haomiao Yang, Mengyu Ge, Jingwei Li, Guowen Xu, and Hongwei Li. Fast generation-based gradient leakage attacks against highly compressed gradients. IEEE INFOCOM 2023 - IEEE Conference on Computer Communications, 2023.

[2] Junyi Zhu and Matthew Blaschko. R-gap: Recursive gradient attack on privacy. arXiv preprint arXiv:2010.07733, 2020.

[3] Abadi, Martin, et al. "Deep learning with differential privacy." Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 2016.