A federated learning-oriented iterative gradient inversion sample reconstruction method

Abstract

The present application relates to a kind of gradient inversion sample reconstruction method under federated learning scene method, belong to artificial intelligence security field.The method is: 1) center server is inserted linear layer structure before participating in training model;2) center server is reconstructed initialization multiple sets of linear layer parameters to different data set distribution;3) according to the model parameter or gradient returned by user, preliminary reconstruction input in single group;4) the input of single group successfully reconstructed is collected again, and the contribution of gradient minus the reconstructed sample is calculated;5) continue to try to reconstruct input based on the gradient of contribution minus, iterate the above process until sample cannot be reconstructed or all samples are reconstructed.The present application studies the data privacy invasion problem of center server based on gradient inversion under federated learning scene, and the method is helpful to promote the improvement of federated learning training data privacy protection.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security and relates to an iterative gradient inversion sample reconstruction method for federated learning. Background Technology

[0002] Federated learning (also known as collaborative learning) aims to train machine learning algorithms on multiple local datasets contained within local nodes without explicitly exchanging data samples. Its basic principle is to train a local model on local data samples and then exchange these local models to generate a global model shared by all participants. In a federated learning environment, multiple data holders collaboratively train the model while maintaining data privacy. The core objective of Gradient Inversion (GI) is to reconstruct the original training data using model gradient information. The core mechanism of Federated Learning (FL) is to allow clients to train the model locally, only transmitting gradients or parameter updates between terminals, thereby protecting the privacy of client-owned data. However, GIA's behavior of directly inverting input data through gradients fundamentally undermines this core objective of federated learning. This sample reconstruction paradigm was originally developed by Deep Leakage from... The Gradients (DLG) method was proposed, and research has shown that, in simple models and single-sample scenarios, the original image can be reconstructed from the gradient through optimization. Subsequent research has further expanded its applicability, overcoming the limitations of model complexity and batch data size. The linear layer leakage method addresses the issue that increasing the input dimension also increases the reconstruction difficulty in optimization-based methods. Although the above work can theoretically solve batch processing... The increased size leads to greater difficulty in sample reconstruction, but the number of parameters that need to be modified or added to reconstruct the entire batch of samples is still impractical. To overcome these bottlenecks, we iterate the gradient inversion sample reconstruction method. During reconstruction, we perform multiple binning. The sample sets obtained by reconstructing the parameter gradients of different bins will inevitably differ. At this point, we remove the failed and repeatedly reconstructed samples from the results of multiple binning reconstructions. The integrated result has been proven to be better than the result obtained by a single binning reconstruction. Due to the characteristics of fully connected layers, a single neuron can be perfectly reconstructed when activated by a single sample. Utilizing the characteristic of perfect reconstruction, we can calculate the gradient of any perfect sample obtained from a single binning reconstruction and then remove the influence of that sample from all binning parameters. For other binning modules, eliminating the influence of each sample is equivalent to reducing the batch size. At this point, the probability of perfectly reconstructing samples in other binning modules will undoubtedly be significantly improved. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide an iterative gradient inversion sample reconstruction method for federated learning. To achieve the above objective, this invention provides the following technical solution: an iterative gradient inversion sample reconstruction method for federated learning, comprising the following steps: Step 1: The central server inserts a linear layer structure before the model participating in training; Step 2: The central server initializes multiple sets of linear layer parameters for different dataset distributions; Step 3: Based on the model parameters or gradients returned by the user, the input is initially reconstructed in a single set; Step 4: The gradient of the successfully reconstructed input in a single set is collected and then the contribution of the reconstructed samples is subtracted; Step 5: Based on the gradient after subtracting the contribution, the reconstruction of the input is continued, iterating the above process until no samples can be reconstructed or all samples are reconstructed.

[0004] Optionally, step one specifically includes the following process: In the federated learning protocol, the reconstruction requirement originates from the federated learning central server. The central server can manipulate the model architecture and parameters before sending the model to the client. The client sends its local computation results and updates to the server for aggregation. The central server reconstructs the model by inserting modules into the architecture, aiming to recover private training data. The central server has full control over the federated learning protocol's central server through technical means or by acting as the central server itself, including core operational permissions such as model initialization, parameter configuration, and version distribution. This control status is not perceived by the federated learning participants (clients). Specifically, based on the aforementioned knowledge central server, a linear layer is inserted at the input of the model architecture.

[0005] Optionally, in step two, the weight of a single group ( ) and bias ( The initialization approach revolves around "encoding linear features of data and binning to separate data points," ultimately achieving accurate recovery of individual user data from batch gradients. The initialization of weights and biases satisfies two key requirements: ensuring consistent measurement of a linear feature of the user data (such as image brightness or text vector mean) by the module, and using bias binning to activate different channels (rows) of the module for different data points. This leaves "separable, unique information" in the gradient, avoiding information confusion caused by batch gradient averaging. The core of initialization is that all rows encode the same linear feature, and a linear function of selected data is chosen. The server does not need to know the full picture of the user data, only an estimate. The distribution, All rows are completely identical (or approximately identical), encoding the same linear feature. The purpose of this design is to ensure that each channel (row) of the module repeatedly measures the same data feature, paving the way for subsequent data point separation via bias binning. The initialization goal of B* is to create... Divide the bins into equal-probability bins, allowing different... The data points that are taken activate ReLU nonlinear units in different channels (rows), thereby creating structured differences in the gradient. Specifically, this is achieved by estimating... The cumulative distribution function does not require precise knowledge of the distribution, and then a cumulative distribution function (CDF) is created. There are three equally probable intervals (bins), meaning the probability mass of each bin is... (Right now ), bias of each neuron ,in It is the inverse function of the estimated CDF. If the central server has no knowledge of the target dataset, it is set to the CDF of the standard Gaussian distribution or the Laplace distribution.

[0006] In the linear layer, parameters for different groups are initialized with differentiated weights to adapt to the estimation of different feature distributions. Specifically, if the central server knows the CDFs of different linear combination feature values ​​of the input data, then binning can be performed for each feature CDF. However, in most real-world sample reconstruction environments, the central server rarely has access to any privacy dataset information. Therefore, k weight vector pairs can be randomly initialized. Binning is performed using CDF. Although the randomly initialized weight vectors are obtained through independent sampling, similar sampled weight vectors can lead to similar binning results. Let... , It is an input vector, considering two weights. The correlation coefficient is ; and Variation can be expressed as variance This is used to measure (the larger the variance, the more drastic the fluctuations in the difference, and the greater the probability of large differences). ; ; ;because The elements are independent of each other, and the variance of the element level is ,so It is a diagonal matrix with diagonal elements of 1. .therefore, ; We propose: Let Two weight vectors and Pearson similarity, The difference between the two binning results is greatest when the value is 0. Although each creation Each time element is independently sampled from a (0, 1) normal distribution and then scaled. Statistically... However, there is still a probability that makes and of Therefore, we choose to ensure this through Schmidt orthogonalization. Let the orthogonalized version be... and for , ,at this time: ; After unitization The modulus is 1, so Orthogonalization guarantees ,so At this point, it can be guaranteed and The variance of the difference is the largest, that is, the first... and the Maximize the difference in results from secondary binning. and The inner product can be approximated as the sum of the products of multiple normally distributed variables and a constant, where each element of the summation... and If they all approximately follow a normal distribution, then It can also be approximated as the sum of multiple variables that follow a normal distribution, and because If the mean is 0, then obey At this time, Scaling makes obey In this case, binning the linear combination CDF can be approximated as binning the normally distributed CDF. In practical scenarios, this can be done by... The distribution of the samples is used to deduce the distribution of the linear combination values.

[0007] Optionally, in step three, during any binning after the above initialization, the sample will activate all samples that satisfy the above conditions. The neurons in the binning process need to have their gradients sequentially reduced, starting from the head bin of the current binning, to eliminate the influence of these samples on the tail binning. In the FedSGD configuration, each linear layer uses the ReLU activation function, thus reconstructing the input: In FedAVG, the client performs multiple updates locally, and the final model parameters transmitted to the server are the updated ones. Therefore, we need to avoid situations where a single sample activates multiple neurons. Thus, we use the Hardtanh activation function and modify the initialized weights and biases as follows: This ensures that the sample will not activate neurons representing bins other than its own.

[0008] Optionally, in step four, during the design of the reconstruction module, we performed multiple binning operations. The sample sets obtained from reconstructing the parameters of different bins will inevitably differ. Therefore, by removing failed and repeatedly reconstructed samples from the results of multiple binning reconstructions and integrating them, the final result has been proven to be superior to that obtained from a single binning reconstruction. Furthermore, due to the characteristics of fully connected layers, a single neuron activated by a single sample can be perfectly reconstructed. Utilizing this perfect reconstruction characteristic, the gradient of any perfect sample obtained from a single binning reconstruction can be calculated, and the influence of that sample can be removed from all binning parameters. For other binning modules, eliminating the influence of each sample is equivalent to reducing the batch size. Therefore, the probability of perfectly reconstructing samples in other binning modules will undoubtedly increase significantly.

[0009] Collecting perfectly reconstructed samples is an indispensable step in automated sample reconstruction. During iterative reconstruction, it's crucial to continuously filter out perfectly reconstructed samples from the existing collection. While duplicate reconstructed samples can be easily eliminated through pairwise comparisons, finding perfectly reconstructed samples from a set containing numerous failed reconstructions requires a referenceless image quality assessment technique. The aggregated gradient of a fully connected layer is essentially the mean of the gradients of individual samples. Since the gradient of an individual sample is linearly related to the input, the averaging operation does not change this linearity; therefore, the aggregated gradient can be represented as a linear combination of the inputs. The output of the fully connected layer is obtained by superimposing a bias on a linear transformation of the input and weights. Loss function on weights The gradient is ,in It is the derivative of the loss with respect to the neuron's output (with respect to the input). (Irrelevant), it can be seen that the gradient of a single sample is related to the input. They exhibit a strictly linear relationship, with coefficients of Therefore, the essential problem to solve is the classification of linearly blended images and natural images. To address this, a central server needs to prepare a pre-trained no-reference image quality scoring model to score all reconstructed samples, retaining those whose quality scores meet the threshold for natural samples. The scoring model needs to be pre-trained on the central server; collecting images of any resolution and generating linearly blended images is not a stringent assumption in real-world reconstruction environments. The scoring model can use deep learning-based methods or methods that consider image metrics (such as entropy), differing only in efficiency. After collecting perfectly reconstructed samples, the gradient of the model parameters with respect to the reconstructed samples can be calculated, and the gradient contributions of these reconstructed samples can be subtracted from the original gradient.

[0010] Optionally, in step five, the iterative process of steps three and four can be repeated to eliminate the gradient of perfectly reconstructed samples until a perfect sample cannot be reconstructed or all samples in the batch have been successfully reconstructed. Compared to simply refining the bins, multiple binning and reconstruction require a smaller module size to achieve the same reconstruction effect. Furthermore, the iterative reconstruction strategy brought about by multiple binning further reduces the parameter size of the reconstruction module, enhancing the reconstruction effect while also reducing the impact of the reconstruction module on the overall model.

[0011] To ensure that gradient calculations in the binning module depend only on the sample's own features, a Connect layer is introduced. The core function of this layer is to integrate the outputs of the binning module, ensuring that the outputs of different neurons in the binning module are processed with the same parameters in subsequent feedforward processes. Then, the output of the Connect layer is concatenated with the original input features, thus ensuring that the output dimension of the reconstruction module is completely consistent with the original input dimension. Simultaneously, since the reconstruction module only makes small, local modifications to the original input features (e.g., a single pixel value in an image), this design minimizes the impact of introducing the reconstruction module on the model's original task performance, ensuring that the model's fundamental functionality is not significantly affected.

[0012] Other advantages, objectives, and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from the following examination, or may be learned from practice of the invention. The objectives and other advantages of the invention can be realized and obtained through the following description. Attached Figure Description

[0013] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein: Figure 1 This is a schematic diagram of the sample reconstruction process based on gradient inversion of multidimensional features; Figure 2 To reconstruct the module structure diagram. Detailed Implementation

[0014] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0015] The accompanying drawings are for illustrative purposes only and are schematic diagrams, not actual pictures. They should not be construed as limiting the invention. To better illustrate the embodiments of the invention, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product dimensions. It is understandable to those skilled in the art that some well-known structures and their descriptions may be omitted in the drawings.

[0016] In the accompanying drawings of the embodiments of the present invention, the same or similar reference numerals correspond to the same or similar components. In the description of the present invention, it should be understood that if terms such as "upper," "lower," "left," "right," "front," and "rear" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, the terms used to describe positional relationships in the drawings are only for illustrative purposes and should not be construed as limiting the present invention. For those skilled in the art, the specific meaning of the above terms can be understood according to the specific circumstances.

[0017] See Figures 1-2 This invention provides an iterative gradient inversion sample reconstruction method for federated learning. Figure 1 A flowchart for the specific implementation; Figure 2 To reconstruct the model structure diagram, the following steps are described in conjunction with the accompanying drawings.

[0018] Optionally, step one specifically includes the following process: In the federated learning protocol, the reconstruction request originates from the federated learning center server. The center server can manipulate the model architecture and parameters before sending the model to the client. The client sends its local computation results and updates to the server for aggregation. The center server initiates sample reconstruction by inserting a reconstruction module into the architecture, with the goal of recovering the private training data.

[0019] The central server has acquired complete control over the federated learning protocol's central server through technical means or by acting as the central server itself. This includes core operational permissions such as model initialization, parameter configuration, and version distribution, and this control status is not perceived by the federated learning participants (clients). Specifically, based on the aforementioned knowledge central server, a linear layer is inserted at the input of the model architecture.

[0020] Optionally, in step two, the weight of a single group ( ) and bias ( The initialization approach revolves around "encoding linear features of data and binning to separate data points," ultimately achieving accurate recovery of individual user data from batch gradients. The initialization of weights and biases satisfies two key requirements: ensuring consistent measurement of a linear feature of the user data (such as image brightness or text vector mean) by the module, and using bias binning to activate different channels (rows) of the module for different data points, thereby leaving "separable, unique information" in the gradient and avoiding information confusion caused by batch gradient averaging. The core of initialization is that all rows encode the same linear feature. A linear function of the chosen data is used. The server does not need to know the full picture of user data, only an estimate. The distribution of . All rows are completely identical (or approximately identical), encoding the same linear feature. The purpose of this design is to ensure that each channel (row) of the module repeatedly measures the same data feature, paving the way for subsequent data point separation via bias binning. The initialization goal of B* is to create... Divide the bins into equal-probability bins, allowing different... The data points that are selected activate ReLU nonlinear units in different channels (rows), thereby creating structured differences in the gradient. Specifically, this involves estimating... The cumulative distribution function does not require precise knowledge of the distribution, and then it is created based on the CDF. There are three equally probable intervals (bins), meaning the probability mass of each bin is... (Right now ), bias of each neuron ,in It is the inverse function of the estimated CDF. If the central server has no knowledge of the target dataset, it is set to the CDF of the standard Gaussian distribution or the Laplace distribution.

[0021] In linear layers, parameters for different groups are initialized with differentiated weights to adapt to estimations of different feature distributions. Specifically, if the central server knows the CDFs of different linear combination feature values ​​of the input data, then binning can be performed for each feature CDF. However, in most real-world federated learning environments, the central server rarely has access to any privacy datasets; therefore, k weight vectors can be randomly initialized. Binning is performed using CDF. Although the randomly initialized weight vectors are obtained through independent sampling, similar sampled weight vectors can lead to similar binning results. Let... , It is an input vector, considering two weights. The correlation coefficient is ; and Variation can be expressed as variance This is used to measure (the larger the variance, the more drastic the fluctuations in the difference, and the greater the probability of large differences). ; ; ;because The elements are independent of each other, and the variance of the element level is ,so It is a diagonal matrix with diagonal elements of 1. .therefore, ; We propose: Let Two weight vectors and Pearson similarity, The difference between the two binning results is greatest when the value is 0. Although each creation Each time element is independently sampled from a (0, 1) normal distribution and then scaled. Statistically... However, there is still a probability that makes and of Therefore, we choose to ensure this through Schmidt orthogonalization. Let the orthogonalized version be... and for , ,at this time: ; After unitization The modulus is 1, so Orthogonalization guarantees ,so At this point, it can be guaranteed and The variance of the difference is the largest, that is, the first... and the Maximize the difference in results from secondary binning. and The inner product can be approximated as the sum of the products of multiple normally distributed variables and a constant, where each element of the summation... and If they all approximately follow a normal distribution, then It can also be approximated as the sum of multiple variables that follow a normal distribution, and because If the mean is 0, then obey At this time, Scaling makes obey In this case, binning the linear combination CDF can be approximated as binning the normally distributed CDF. In practical scenarios, this can be done by... The distribution of the samples is used to deduce the distribution of the linear combination values.

[0022] Optionally, in step three, during any binning after the above initialization, the sample will activate all samples that satisfy the above conditions. The neurons in the binning process need to have their gradients sequentially reduced, starting from the head bin of the current binning, to eliminate the influence of these samples on the tail binning. In the FedSGD configuration, each linear layer uses the ReLU activation function, thus reconstructing the input: In FedAVG, the client performs multiple updates locally, and the final model parameters transmitted to the server are the updated ones. Therefore, we need to avoid situations where a single sample activates multiple neurons. Thus, we use the Hardtanh activation function and modify the initial weights and biases as follows: This ensures that the sample will not activate neurons representing bins other than its own.

[0023] Optionally, in step four, when designing the insertion module, we performed multiple binning operations. The sample sets obtained by reconstructing the parameter gradients of different bins will inevitably differ. In this case, samples that failed to be reconstructed and those that were repeatedly reconstructed are removed from the results of multiple binning reconstructions. The integrated result has been proven to be superior to the result obtained from a single binning reconstruction. Due to the characteristics of fully connected layers, a single neuron can be perfectly reconstructed when activated by a single sample. Utilizing the characteristic of perfect reconstruction, the gradient of any perfect sample obtained from a binning reconstruction can be calculated, and the influence caused by that sample can be removed from all binning parameters. For other binning modules, eliminating the influence of each sample is equivalent to reducing the batch size. At this time, the probability of perfectly reconstructing the sample in other binning modules will undoubtedly be significantly improved.

[0024] Collecting perfectly reconstructed samples is an indispensable step in automated sample reconstruction. During iterative reconstruction, it's crucial to continuously filter out perfectly reconstructed samples from the existing collection. While duplicate reconstructed samples can be easily eliminated through pairwise comparisons, finding perfectly reconstructed samples from a set containing numerous failed reconstructions requires a referenceless image quality assessment technique. The aggregated gradient of a fully connected layer is essentially the mean of the gradients of individual samples. Since the gradient of an individual sample is linearly related to the input, the averaging operation does not change this linearity; therefore, the aggregated gradient can be represented as a linear combination of the inputs. The output of the fully connected layer is obtained by superimposing a bias on a linear transformation of the input and weights. Loss function on weights The gradient is ,in It is the derivative of the loss with respect to the neuron's output (with respect to the input). (Irrelevant), it can be seen that the gradient of a single sample is related to the input. They exhibit a strictly linear relationship, with coefficients of Therefore, the essential problem to solve is the classification of linearly mixed images versus natural images. To address this, a central server needs to prepare a pre-trained no-reference image quality scoring model to score all reconstructed samples, retaining those whose quality scores meet the threshold for natural images. The scoring model needs to be pre-trained on the central server; collecting images of any resolution and generating linearly mixed images is not a stringent assumption in real-world scenarios. The scoring model can use deep learning-based methods or methods that consider image metrics (such as entropy), differing only in efficiency. After collecting perfectly reconstructed samples, the gradient of the model parameters with respect to the reconstructed samples can be calculated, and the gradient contributions of these reconstructed samples can be subtracted from the original gradient.

[0025] Optionally, in step five, the iterative process of steps three and four can be repeated to eliminate the perfectly reconstructed sample gradient until a perfect sample cannot be reconstructed or all samples in the batch have been successfully reconstructed. Compared to simply refining the bins, multiple binning and reconstruction require a smaller sample reconstruction module to achieve the same reconstruction effect. Furthermore, the iterative reconstruction strategy brought about by multiple binning further reduces the parameter size of the sample reconstruction module, enhances the sample reconstruction effect, and also increases the concealment of the central server.

[0026] To ensure that gradient calculations in the binning module depend only on the sample's own features, a Connect layer is introduced. The core function of this layer is to integrate the outputs of the binning module, ensuring that the outputs of different neurons in the binning module are processed with the same parameters in subsequent feedforward processes. Then, the output of the Connect layer is concatenated with the original input features, thus ensuring that the output dimension of the reconstruction module is completely consistent with the original input dimension. Simultaneously, since the central server module only makes small, local modifications to the original input features (e.g., a single pixel value in an image), this design minimizes the impact of the reconstruction module on the model's original task performance, ensuring that the model's fundamental functionality is not significantly affected.

[0027] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. An iterative gradient inversion sample reconstruction method for federated learning, characterized in that: The method includes the following steps: Step 1: The central server inserts a linear layer structure before the model participating in training; Step 2: The central server initializes multiple sets of linear layer parameters for different dataset distributions; Step 3: Based on the model parameters or gradients returned by the user, the input is initially reconstructed in a single set; Step 4: The gradient of the successfully reconstructed input in a single set is collected and then subtracted from the contribution of the reconstructed samples; Step 5: Based on the gradient after subtracting the contribution, the method continues to attempt to reconstruct the input, iterating the above process until no samples can be reconstructed or all samples are reconstructed.

2. The iterative gradient inversion sample reconstruction method for federated learning according to claim 1, characterized in that: The specific process of step one includes: We consider a federated learning protocol, where a central server originates from the federated learning server. The central server can manipulate the model architecture and parameters before sending the model to the client. The client sends its local computation results and updates to the server, where aggregation is performed. The central server initiates reconstruction by inserting modules into the architecture, aiming to restore private training data. The central server, through technical means or by acting as the central server itself, possesses complete control over the federated learning protocol's central server, including core operational permissions such as model initialization, parameter configuration, and version distribution, and this control status is not perceived by the federated learning participants (clients). Specifically, based on the above knowledge, the central server inserts a linear layer at the input of the model architecture.

3. The iterative gradient inversion sample reconstruction method for federated learning according to claim 2, characterized in that: In step two, the weight of a single group ( ) and bias ( The initialization approach revolves around "encoding linear features of data and binning to separate data points," ultimately achieving accurate recovery of individual user data from batch gradients. The initialization of weights and biases satisfies two key requirements: ensuring consistent measurement of a linear feature of the user data (such as image brightness or text vector mean) by the module, and using bias binning to activate different channels (rows) of the module for different data points, thereby leaving "separable, unique information" in the gradient and avoiding information confusion caused by batch gradient averaging. The core of initialization is that all rows encode the same linear feature. A linear function of the chosen data is used. . The server does not need to know the full picture of the user data, only an estimate. The distribution of . All rows are completely identical (or approximately identical), encoding the same linear feature. The initialization goal of B* is to create Divide the bins into equal-probability bins, allowing different... The data points that are selected activate ReLU nonlinear units in different channels (rows), thereby creating structured differences in the gradient. Specifically, this involves estimating... The cumulative distribution function does not require precise knowledge of the distribution, and then it is created based on the CDF. There are three equally probable intervals (bins), meaning the probability mass of each bin is... (Right now ), bias of each neuron ,in It is the inverse function of the estimated CDF. If the central server has no knowledge of the target dataset, it is set to the CDF of the standard Gaussian distribution or the Laplace distribution. The parameters of different groups in the linear layer are initialized with differentiated weights to adapt to the estimation of different feature distributions. Specifically, if the central server knows the CDF of different linear combination feature values ​​of the input data, then for each feature CDF, a binning operation can be performed. However, in most real-world environments, it is difficult for the central server to obtain any information about the privacy dataset. Therefore, k weight vectors can be randomly initialized. Binning is performed using CDF. Although the randomly initialized weight vectors are obtained through independent sampling, similar sampled weight vectors can lead to similar binning results. Therefore, we propose: Let... Two weight vectors and Pearson similarity, The difference between the two binning results is greatest when the value is 0, although each creation Each time element is independently sampled from a (0, 1) normal distribution and then scaled. Statistically... However, there is still a probability that makes and of Therefore, we choose to ensure this through Schmidt orthogonalization. Let the orthogonalized version be... and for , ,at this time: ; After unitization The modulus is 1, so Orthogonalization guarantees ,so At this point, it can be guaranteed and The variance of the difference is the largest, that is, the first... and the Maximize the difference in results from secondary binning. and The inner product can be approximated as the sum of the products of multiple normally distributed variables and a constant, where each element of the summation... and If they all approximately follow a normal distribution, then It can also be approximated as the sum of multiple variables that follow a normal distribution, and because... If the mean is 0, then obey At this time, Scaling makes obey In this case, binning the linear combination CDF can be approximated as binning the normally distributed CDF. In practical scenarios, it can be determined according to... The distribution of the samples is used to deduce the distribution of the linear combination values.

4. The iterative gradient inversion sample reconstruction method for federated learning according to claim 3, characterized in that: In step three, during any binning process following the initialization described above, the sample will activate all samples that satisfy the above conditions. The neurons in the binning process need to have their gradients sequentially reduced, starting from the head bin of the current binning, to eliminate the influence of these samples on the tail binning. In the FedSGD configuration, each linear layer uses the ReLU activation function, thus reconstructing the input: In FedAVG, since the client performs multiple updates locally, the final model parameters transmitted to the server are the updated ones. Therefore, it is necessary to avoid the situation where a single sample activates multiple neurons. So, we use the Hardtanh activation function and modify the initial weights and biases as follows: This ensures that the sample will not activate neurons representing bins other than its own.

5. The iterative gradient inversion sample reconstruction method for federated learning according to claim 4, characterized in that: In step four, during the design of the reconstruction module, we performed multiple binning operations. The sample sets obtained from reconstructing the parameters of different bins will inevitably differ. Therefore, by removing failed and repeatedly reconstructed samples from the results of multiple binning reconstructions and integrating them, we obtain a result that has been proven superior to that obtained from a single binning reconstruction. Due to the characteristics of fully connected layers, a single neuron activated by a single sample can be perfectly reconstructed. Utilizing this perfect reconstruction characteristic, we can calculate the gradient of any perfectly reconstructed sample obtained from a single binning reconstruction and then remove the influence of that sample from all binning parameters. For other binning modules, eliminating the influence of each sample is equivalent to reducing the batch size. This significantly increases the probability of perfectly reconstructing samples in other binning modules. Collecting perfectly reconstructed samples is an indispensable step in automated sample reconstruction. During iterative reconstruction, it is continuously necessary to filter out perfectly reconstructed samples from the existing reconstructed samples. Repeatedly reconstructed samples can be easily filtered out by pairwise filtering. In contrast to the elimination process, to find perfectly reconstructed samples from a set containing numerous failed reconstruction samples, we consider introducing a no-reference image quality assessment technique. The aggregated gradients from fully connected layers can be represented as a linear combination of the inputs used to generate them. Therefore, the essential problem to solve is the classification of linearly mixed images and natural images. To address this, a pre-trained no-reference image quality scoring model needs to be prepared by the central server to score all reconstructed samples, retaining those whose quality scores meet the threshold of natural samples. The scoring model needs to be pre-trained by the central server. Collecting images of any resolution and generating linearly mixed images is not a demanding assumption in real-world environments. The scoring model can use deep learning-based methods or methods that consider image metrics (such as entropy). The only difference between the two is efficiency. After collecting perfectly reconstructed samples, the gradients of the model parameters with respect to the reconstructed samples can be calculated, and the gradient contributions of these reconstructed samples can be subtracted from the original gradients.

6. The iterative gradient inversion sample reconstruction method for federated learning according to claim 5, characterized in that... Step five is essentially an iterative process of steps three and four. This involves repeatedly eliminating perfectly reconstructed sample gradients until no more perfect samples can be reconstructed or all samples in the batch have been successfully reconstructed. Compared to simply refining the bins, multiple binning reconstructions require a smaller reconstruction module to achieve the same reconstruction effect. The iterative reconstruction strategy resulting from multiple binnings further reduces the parameter size of the reconstruction module, enhancing the reconstruction effect while minimizing the module's impact on the overall model. To ensure that gradient calculations in the binning module rely solely on the sample's own features, a Connect layer is introduced. The core function of this layer is to integrate the outputs of the binning module, ensuring that the outputs of different neurons in the binning module are processed with the same parameters in subsequent feedforward processes. Subsequently, the output of the Connect layer is concatenated with the original input features, ensuring that the output dimension of the reconstruction module is completely consistent with the original input dimension. Furthermore, since the reconstruction module only makes small, local modifications to the original input features (e.g., a single pixel value in an image), this design minimizes the disturbance to the model's original task performance after the reconstruction module is introduced, ensuring that the model's fundamental functions are not significantly affected.

Images