A three-stage gradient inversion attack method and system based on a variational autoencoder

Abstract

This invention proposes a three-stage gradient inversion attack method and system based on variational autoencoders, relating to the fields of artificial intelligence and computer vision. In existing technologies, within a federated learning framework, attackers may reconstruct original training samples from gradient updates shared by trainers, thereby stealing sensitive information. To address this, this invention sequentially performs three stages of optimization training, eliminating reliance on task-specific priors. It eliminates the need for pre-training the model by having prior knowledge of the target dataset; instead, it simply uploads the corresponding gradient update values ​​to the server, thus protecting privacy and making the attack hypothesis more closely resemble real-world federated learning scenarios. It enhances the adaptive correction capability for semantic priors, eliminates semantic ambiguity, and improves image reconstruction quality. Furthermore, it improves the reconstruction effect on large batches of samples, ensuring attack effectiveness while reducing attack time.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and computer vision technology, and in particular to a three-stage gradient inversion attack method and system based on variational autoencoders. Background Technology

[0002] Federated Learning (FL) is an emerging distributed collaborative training architecture. Under this framework, each client trains its local model based on its private dataset and uploads the corresponding gradient update values ​​to the server, which then aggregates and updates the global model. Currently, the FL framework has been widely used in various training tasks such as natural language processing and computer vision, and its role is particularly prominent in applications with high data privacy protection requirements, such as medical diagnosis and financial risk control. With the development of technologies such as the Internet of Things and edge computing, the application of FL is gradually evolving from centralized, cross-organizational scenarios to decentralized, cross-device scenarios. Edge devices, such as wearable devices, which are the main bodies for data collection and model training, are increasingly close to the human body. The data they collect and process often involves highly sensitive information such as personal physiology and health, highlighting the urgent need for such data privacy protection mechanisms.

[0003] However, the privacy provided by current federated learning (FL) frameworks is severely threatened by gradient inversion attacks (GIA). Attackers attempt to reconstruct their original training samples from gradient updates shared by other trainers, thereby stealing sensitive information and compromising privacy. Furthermore, these attacks employ iterative optimization-based inversion methods, a typical example being the Deep Leakage of Gradients (DLG) scheme. Existing solutions suffer from overly idealized attack assumptions, excessive reliance on semantic priors, and low attack efficiency, failing to accurately simulate real-world attack threats and leading to biased assessments of the privacy of federated learning frameworks. Federated learning protects privacy by requiring clients to upload only gradient updates rather than the original data.

[0004] To address the aforementioned issues, a method is urgently needed that allows training on a local private dataset, uploading corresponding gradient update values ​​to a server for aggregation and updating, while simultaneously protecting the privacy of the trainer. Typically, users need to repeatedly update the global model after aggregating dataset information until the global model converges. Therefore, this application designs a method where, during dataset collaboration, only gradient updates are shared; the trainer's private dataset remains locally, thus prioritizing the protection of trainer privacy and achieving a "data usable but not visible" effect. Furthermore, this secure and efficient training method also enables plug-and-play cross-dataset attacks, and because it is based on a three-stage gradient inversion attack framework using a variational autoencoder, attack efficiency is improved. Summary of the Invention

[0005] To address the shortcomings of existing technologies, such as reliance on idealized attack assumptions during model training, heavy dependence on semantic priors, and low attack efficiency, which lead to the theft of sensitive information from trainers and compromise of privacy, this invention first proposes a three-stage gradient inversion attack method based on variational autoencoders, aiming for plug-and-play functionality and improved attack efficiency. In this method, trainers use local private datasets for training and only upload gradient update values ​​to the server for aggregation and updating, thus achieving model collaboration while protecting trainer privacy. The method specifically includes the following steps: Step S1: Perform latent space search, optimize the initialized latent space encoding, and generate semantic priors; Step S2: Perform pixel space search to iteratively optimize the semantic prior mapping in pixel space and generate the optimized reconstructed image; Step S3: Perform parameter space search to fine-tune the encoder weights of encoder E to correct structural biases in the reconstructed image and generate the final inversion image.

[0006] Furthermore, step S1 also includes the following steps: Step S11: Initialize the latent space encoding, input the latent space encoding into the decoder D, and map it to the semantic prior of the pixel space; Step S12: Input the semantic prior into the global model for training, derive the accurate label y, and calculate the virtual gradient; Step S13: Calculate the gradient matching loss L1 between the virtual gradient and the real gradient, and iteratively update the latent space encoding through backpropagation until the loss is minimized to obtain the optimal semantic prior.

[0007] Furthermore, step S2 also includes the following steps: Step S21: Input the optimal semantic prior into the global model, and calculate the virtual gradient by combining it with the accurate label y; Step S22: Calculate the gradient matching loss L2 between the virtual gradient and the real gradient, and iteratively update it in the pixel space through backpropagation to obtain the optimized reconstructed image.

[0008] Furthermore, step S3 also includes the following steps: Step S31: Input the optimized reconstructed image into encoder E, and after encoding, obtain the latent space code, and then map it into pixel space result through decoder D; Step S32: Input the pixel space result into the global model, and calculate the virtual gradient by combining it with the accurate label y; Step S33: Freeze the parameters of decoder D, calculate the gradient matching loss L3 between the virtual gradient and the real gradient, fine-tune the encoder weights of encoder E through backpropagation, and keep the weights of decoder D frozen. Step S34: Use the reconstruction result corresponding to the fine-tuned encoder weights as the final inversion image output.

[0009] Furthermore, both decoder D and encoder E are derived from stable diffusion models pre-trained on public datasets, without retraining for the target dataset, resulting in a plug-and-play cross-dataset attack method.

[0010] Furthermore, the gradient matching loss is calculated based on the cosine similarity between the virtual gradient and the real gradient, and combined with the regularization terms corresponding to each stage to optimize image features in different dimensions: in step S1, structural information is restored; in step S2, texture and color are optimized; and in step S3, structural deviations are corrected.

[0011] Furthermore, the precise label y is derived based on gradient analysis and does not rely on prior knowledge of the target dataset.

[0012] According to another aspect of the present invention, a three-stage gradient inversion attack system based on a variational autoencoder is also proposed. The system is applicable to the above-mentioned three-stage gradient inversion attack method based on a variational autoencoder, and specifically includes the following modules: The latent space search module, containing a decoder D, is used to map the initialized latent encodings to semantic priors; The pixel space search module, connected to the latent space module, is used for iterative optimization of the image in the pixel space. The parameter space search module, connected to the pixel space search module, contains an encoder E and a decoder D with frozen weights, used to correct image structure deviations by fine-tuning the encoder weights of encoder E.

[0013] Furthermore, both encoder E and decoder D originate from pre-trained generative models and are not pre-trained or fine-tuned for specific task datasets, i.e., they are applied to target samples with different data distributions.

[0014] Furthermore, in the context of federated learning, gradient updates are used as input to output reconstructed original training samples, thereby assessing the privacy leakage risk under the federated learning framework.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: First, this invention employs a three-stage inversion attack method, sequentially performing three stages of optimization training to eliminate reliance on task-specific priors. This means attackers do not need to pre-train the model using the target dataset. Furthermore, when attacking samples from different datasets, there is no need to retrain the model, achieving a plug-and-play cross-dataset attack effect. This makes the attack assumptions more closely resemble real-world federated learning scenarios.

[0016] Secondly, the initialized latent space encoding is mapped to the pixel space using a variational autoencoder model, serving as a semantic prior. This enhances the adaptive correction capability for the semantic prior. Building upon the previous two stages of searching in the latent space and pixel space, a third stage of parameter space search is added to correct structural errors in the semantic prior output from the first stage, thereby eliminating semantic ambiguity and improving image reconstruction quality.

[0017] Third, this invention is based on a three-stage sequential optimization training process, iteratively optimizing the mapped content to form the optimal semantic prior. This enhances the framework's ability to correct semantic priors, eliminating semantic ambiguity without relying on group strategies and improving reconstruction performance for large batches of samples. It also significantly improves attack efficiency, reducing attack time while ensuring attack effectiveness. Attached Figure Description

[0018] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 The flowchart shows the three-stage gradient inversion attack method based on variational autoencoder. Figure 2 This is a structural diagram of a three-stage gradient inversion attack system based on a variational autoencoder. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0021] The specific embodiments of the present invention will be described below.

[0022] To address the shortcomings of existing technologies, such as reliance on idealized attack assumptions during model training, heavy dependence on semantic priors, and low attack efficiency, which lead to the theft of sensitive information from trainers and compromise of privacy, this invention first proposes a three-stage gradient inversion attack method based on variational autoencoders. This method is plug-and-play and improves attack efficiency. Trainers train on their local private datasets and upload the corresponding gradient update values ​​to the server for aggregation and updating, while simultaneously protecting trainer privacy.

[0023] Example 1 like Figure 1 As shown, this invention proposes a three-stage gradient inversion attack method based on a variational autoencoder, which specifically includes the following steps: Step S1 involves performing a latent space search, optimizing the initialized latent space encoding, and generating semantic priors. In this embodiment, step S1 is used as the first stage of optimization training in the entire method. That is, in this step, a Stable Diffusion model (a text-to-image generation technique based on the Large-scale Artificial Intelligence Open Network (LAION) dataset) pre-trained using a Variational Auto Encoder (VAE) is mainly used to map the latent space encoding to the pixel space, serving as the initial input for subsequent stages to achieve rapid recovery of structural information. For ease of description, the encoder part of the VAE pre-trained model used in this application is denoted as encoder E, and the decoder part is denoted as decoder D. By optimizing the latent space encoding, the macroscopic structural information of the image is quickly recovered. Specifically, step S1 also includes the following steps: Step S11: Initialize the latent space encoding. Input the latent space encoding into the decoder D and map it to the semantic prior of the pixel space. Define the initialized latent space encoding as z, and let the latent space encoding z be used as the input in step S1. After passing through the decoder D, it is mapped to the pixel space result. .

[0024] First, a latent space encoding vector is initialized, with the same dimension as the latent space dimension of the pre-trained encoder E. Typically, this encoding is randomly sampled from a standard normal distribution. This initial latent encoding is then input into the pre-trained decoder D, which maps it to an image in pixel space, called the semantic prior.

[0025] Step S12: Input the semantic prior into the global model for training, derive the accurate label y, and calculate the virtual gradient. The input is fed into the global model, which is an aggregation of local models from multiple clients in federated learning. The normal training process is performed, and the precise label y is derived. The virtual gradient is then calculated using the precise label y. The generated semantic prior image is input into the global model in federated learning, a forward propagation is performed, and the precise label used when training the sample is derived using gradient information. The label derivation can be accomplished by analyzing the sign of the gradient or by using existing label inference methods, such as methods based on gradient sign differences. The entire process requires no prior knowledge of the target dataset.

[0026] Step S13: Calculate the gradient matching loss L1 between the virtual gradient and the real gradient, and iteratively update the latent space encoding through backpropagation until the loss is minimized, thus obtaining the optimal semantic prior. Calculate the virtual gradient. With the true gradient gradient matching loss Then calculate the gradient of L1 with respect to z. This guides z to iteratively update to the optimal value in the latent space, minimizing L1, i.e.: ; The optimal semantic prior is obtained through backpropagation after iteration, let corresponding This semantic prior serves as input for the second-stage initialization. Based on the semantic prior image and the derived labels, a set of virtual gradients is calculated through a global model. Simultaneously, the attacker has obtained the real gradients uploaded by the client, aiming to minimize the difference between the virtual and real gradients. To this end, a gradient matching loss function is defined, which measures the cosine similarity of the two sets of gradients and incorporates a total variational regularization term to maintain the smoothness of the generated image. The closer the cosine similarity is to 1, the more closely the two sets of gradients match; the total variational regularization term encourages smooth pixel changes within the image, avoiding noise.

[0027] The gradient of the gradient matching loss with respect to the latent encoding is calculated using the backpropagation algorithm, and the latent encoding is iteratively updated using the optimizer. After each update, the new latent encoding is used again by the decoder D to generate a new semantic prior, and the loss is recalculated. This process is repeated until the loss converges or the preset number of iterations is reached. After the iterations are completed, the optimal latent encoding is obtained, and its corresponding semantic prior image is the output of this step, called the optimal semantic prior. This image has a macroscopic structure similar to the original training samples.

[0028] Step S2 involves performing a pixel space search to iteratively optimize the semantic prior mapping in the pixel space and generate the optimized reconstructed image. Step S2 is considered the second stage. Following the existing design, iterative optimization of the semantic prior output from the first stage is performed in the pixel space, ultimately serving as the initial input for the third stage. In practical applications, this is used to enhance color saturation. This initial image is then input back into the global model, and using the same derived labels, a virtual gradient is calculated. A gradient matching loss function is defined again, but this time, in addition to the cosine similarity term between the virtual and real gradients, a pixel consistency constraint is added: the pixel mean square error between the current image and the optimal semantic prior image. This constraint prevents the image from being over-optimized in the pixel space and deviating from the structural rationality guaranteed by the semantic prior.

[0029] Step S21: Input the optimal semantic prior into the global model, and calculate the virtual gradient by combining it with the precise label y. The semantic prior output in the first stage... The input is fed into the global model to derive the precise label y, and then the virtual gradient is calculated. .

[0030] Step S22: Calculate the gradient matching loss L2 between the virtual gradient and the real gradient, and iteratively update it in the pixel space through backpropagation to obtain the optimized reconstructed image. Since calculating the virtual gradient optimizes the squared difference between it and the real gradient, and then backpropagation is performed to update the virtual input and output, making the virtual gradient match the real gradient, the final virtual input and output will gradually approach the real input and output, achieving the reverse inference of the original data. Therefore, continue calculating the virtual gradient. With the true gradient gradient matching loss Calculate L2 relative to gradient guiding semantic priors Iteratively update within the pixel space until the optimal value is reached, minimizing L2, which gives: ; in, This serves as the initial input for the third stage. The gradient of the loss function with respect to the image pixel values ​​is calculated via backpropagation, and then the image itself is updated using the optimizer. The iterative process continues until the loss converges or a predetermined number of iterations is reached—typically more than the first stage—to fully optimize the details. After each iteration, the image pixel values ​​are fine-tuned, gradually approximating the true gradient with the virtual gradient while maintaining structural consistency with the semantic prior. After the iterations are complete, the optimized image is obtained, which retains the correct macroscopic structure while having richer texture and color, and more closely resembles the visual quality of the original training samples.

[0031] Step S3 involves performing a parameter space search to fine-tune the encoder weights of encoder E to correct structural biases in the reconstructed image, generating the final inverted image. Step S3 is considered the third stage. This stage primarily involves iterative optimization operations using encoder E, decoder D, and a Stable Diffusion model pre-trained on the LAION dataset to correct structural biases and promote stable gradient flow during training. Although the first two steps can reconstruct relatively high-quality images, subtle structural biases may still exist for complex models or high-resolution images. This step corrects these structural biases by fine-tuning the parameters of encoder E, further improving reconstruction accuracy.

[0032] Step S31: Input the optimized reconstructed image into encoder E, and after encoding, obtain the latent space code, which is then mapped to the pixel space result by decoder D.

[0033] Step S32: Input the pixel space result into the global model, and calculate the virtual gradient by combining it with the accurate label y.

[0034] Step S33: Freeze the decoder D parameters, calculate the gradient matching loss L3 between the virtual and real gradients, fine-tune the encoder weights of encoder E through backpropagation, and keep the decoder D weights frozen. Freeze decoder parameters. Calculate the matching loss L3 relative to the encoder weights. gradient And then iteratively update To reach the optimal state, minimizing L3, we have: ; Step S34: The reconstruction result corresponding to the fine-tuned encoder weights is used as the final inversion image output. The output of the second stage... The result of the fine-tuned encoder E and decoder D is the final output value of the three-stage gradient inversion framework, resulting in the inverted image. This reconstructed image is then input into the global model again, and the virtual gradient is calculated using the same derived labels. A gradient matching loss function for the third stage is defined, which also includes a cosine similarity term between the virtual and real gradients, and incorporates a latent space constraint: the Euclidean distance between the current latent code and the optimal latent code obtained in step S1. After iteration, the final reconstructed image is used as the output of the three-stage gradient inversion attack. This image not only preserves the correct macroscopic structure and rich texture details, but also corrects for potential structural biases through fine-tuning of encoder E, achieving optimal overall quality.

[0035] Based on the three-stage inversion attack method, three stages of optimization training are performed sequentially, eliminating the dependence on task-specific priors. This means that attackers do not need to have prior knowledge of the target dataset to pre-train the generative model. Furthermore, when attacking samples from different datasets, there is no need to retrain the generative model, enabling plug-and-play cross-dataset attacks. This makes the attack assumptions more closely resemble real-world federated learning scenarios.

[0036] Specifically, in this embodiment, both decoder D and encoder E originate from stable diffusion models pre-trained on public datasets, without retraining for the target dataset, resulting in plug-and-play cross-dataset attacks. This improves attack efficiency while reducing attack time, providing a technical basis for building a more comprehensive and robust defense mechanism. The gradient matching loss is calculated based on the cosine similarity between the virtual and real gradients, and combined with regularization terms corresponding to each stage to optimize image features in different dimensions: restoring structural information in step S1, optimizing texture and color in step S2, and correcting structural biases in step S3. Enhanced adaptive correction capability for semantic priors is achieved by adding a third-stage parameter space search to correct semantic prior structural errors in the first-stage output, based on latent space search and pixel space search, thereby eliminating semantic ambiguity and improving image reconstruction quality. The precise label y is derived based on gradient analysis and does not rely on prior knowledge of the target dataset.

[0037] In a specific embodiment, for image-based tasks, the performance of inversion attacks is often measured by the quality of reconstructed images and the attack time. Quantitative metrics for evaluating reconstructed image quality include peak signal-to-noise ratio (PSNR), structural similarity index, and learned perceptual patch similarity. The effectiveness of inversion attacks is affected by factors such as global model complexity, image resolution, and batch size. Generally, the more complex the global model, the more layers, the higher the resolution, and the larger the batch size, the worse the inversion performance. Therefore, the FL task is set as image classification, and the co-trained global model consists of convolutional neural networks of different depths and architectures. The AdamW optimizer (Adam Weight Decay) is used in all three optimization stages, with initial learning rates set to 0.1, 0.01, and 0.1 respectively, all employing a learning rate decay mechanism to improve convergence stability.

[0038] Specifically, the first-stage initialization of the latent space encoding follows a Gaussian distribution. The number of iterations for the first, second, and third stages can be set to hundreds, thousands to tens of thousands, and hundreds, respectively, for example, 500, 15,000, and 1,000 iterations. For different datasets, the input samples can be processed to a uniform resolution, for example, cropping the samples to 224×224 resolution and adding pseudo-labels. In addition to conventional quantitative metrics such as peak signal-to-noise ratio and structural similarity index, task-specific metrics are introduced to evaluate the inversion effect of the proposed attack framework on the samples.

[0039] Experimental results show that, compared with existing methods, the gradient inversion attack method of this invention achieves better image reconstruction results and shorter attack time under different batch sizes, verifying its plug-and-play and high-efficiency characteristics. Most samples recover semantic information, and some even recover detailed information. Experimental results demonstrate that the attack framework proposed in this invention can achieve stable reconstruction results under different batch sizes and dataset conditions, and effectively attack heterogeneous datasets without retraining the generative model, exhibiting good generalization ability and plug-and-play characteristics.

[0040] This invention employs a three-stage inversion attack method, sequentially performing three stages of optimization training. This eliminates reliance on task-specific priors, meaning attackers do not need to pre-train the generative model with prior knowledge of the target dataset. Furthermore, when attacking samples from different datasets, there is no need to retrain the generative model, enabling plug-and-play cross-dataset attacks and making the attack hypotheses more closely resemble real-world federated learning scenarios. The initialized latent space encoding is mapped to the pixel space using a variational autoencoder model, serving as the semantic prior. The adaptive correction capability for the semantic prior is enhanced by adding a third stage—a parameter space search—to correct structural errors in the semantic prior output from the first stage, building upon the previous two stages of latent space and pixel space searches. This eliminates semantic ambiguity and improves image reconstruction quality.

[0041] Example 2 like Figure 2 As shown, this invention also proposes a three-stage gradient inversion attack system based on a variational autoencoder, using the three-stage gradient inversion attack method based on a variational autoencoder as described in Example 1, including the following modules: The latent space search module includes a decoder D, used to map the initialized latent code to a semantic prior. Its function is to receive the initialized latent code, generate a semantic prior image through decoder D, and iteratively optimize the latent code until the optimal semantic prior is obtained. This module implements step S1 in Example 1. The pixel space search module is connected to the latent space module and is used to iteratively optimize the image in the pixel space. Iterative optimization of the image in the pixel space enhances the texture and color details of the image by minimizing gradient matching loss, generating an optimized reconstructed image. This module implements step S2 in Example 1. The parameter space search module is connected to the pixel space search module and includes an encoder E and a decoder D with frozen weights, used to correct image structural biases by fine-tuning the encoder weights of encoder E. Its function is to receive the initialized latent code, generate a semantic prior image through decoder D, and iteratively optimize the latent code until the optimal semantic prior is obtained. The optimized image output from the pixel space search module is first encoded by encoder E and then reconstructed by the frozen decoder D. Gradient matching loss is minimized by fine-tuning the encoder E weights, thereby correcting the structural biases of the image and outputting the final inverted image. This module implements step S3 in Example 1.

[0042] The various modules work collaboratively, taking gradient updates as input and outputting reconstructed original training samples. The system adopts a plug-and-play architecture; both encoder E and decoder D are derived from publicly available pre-trained stable diffusion models, eliminating the need for retraining for specific datasets. It does not require pre-training or fine-tuning for specific task datasets, meaning it can be applied to target samples with different data distributions.

[0043] In a federated learning scenario, gradient updates are taken as input, and the reconstructed original training samples are output to assess the privacy leakage risk under the federated learning framework.

[0044] This invention is based on a three-stage sequential optimization training process, iteratively optimizing the mapped content to form the optimal semantic prior. This enhances the framework's ability to correct semantic priors, eliminating semantic ambiguity without relying on "grouping" strategies and improving reconstruction performance for large batches of samples. It also significantly improves attack efficiency, reducing attack time while ensuring attack effectiveness.

[0045] Example 3 An electronic device, comprising: Processor and memory; The processor executes the steps of the three-stage gradient inversion attack method based on variational autoencoder, as described in any of Embodiment 1, by calling programs or instructions stored in memory.

[0046] Example 4 A computer-readable storage medium includes computer program instructions that cause a computer to perform the steps of a three-stage gradient inversion attack method based on a variational autoencoder as described in any of Embodiment 1.

[0047] Computer-readable storage media may take the form of any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0048] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the technical solutions of the embodiments of the present invention.

Claims

1. A three-stage gradient inversion attack method based on variational autoencoders, characterized in that, Includes the following steps: Step S1: Perform latent space search, optimize the initialized latent space encoding, and generate semantic priors; Step S2: Perform pixel space search to iteratively optimize the semantic prior mapping in the pixel space and generate the optimized reconstructed image; Step S3: Perform parameter space search to fine-tune the encoder weights of encoder E to correct the structural deviations of the reconstructed image and generate the final inversion image.

2. The three-stage gradient inversion attack method based on variational autoencoder according to claim 1, characterized in that, Step S1 also includes the following steps: Step S11: Initialize the latent space encoding, input the latent space encoding into the decoder D, and map it to the semantic prior of the pixel space; Step S12: Input the semantic prior into the global model for training, derive the accurate label y, and calculate the virtual gradient; Step S13: Calculate the gradient matching loss L1 between the virtual gradient and the real gradient, and iteratively update the latent space encoding through backpropagation until the loss is minimized to obtain the optimal semantic prior.

3. The three-stage gradient inversion attack method based on variational autoencoder according to claim 2, characterized in that, Step S2 also includes the following steps: Step S21: Input the optimal semantic prior into the global model, and calculate the virtual gradient by combining it with the precise label y; Step S22: Calculate the gradient matching loss L2 between the virtual gradient and the real gradient, and iteratively update it in the pixel space through backpropagation to obtain the optimized reconstructed image.

4. The three-stage gradient inversion attack method based on variational autoencoder according to claim 3, characterized in that, Step S3 also includes the following steps: Step S31: Input the optimized reconstructed image into encoder E, and after encoding, obtain the latent space code, which is then mapped to the pixel space result by decoder D; Step S32: Input the pixel space result into the global model, and calculate the virtual gradient by combining it with the precise label y; Step S33: Freeze the parameters of the decoder D, calculate the gradient matching loss L3 between the virtual gradient and the real gradient, fine-tune the encoder weights of the encoder E through backpropagation, and keep the weights of the decoder D frozen. Step S34: The reconstruction result corresponding to the fine-tuned encoder weights is used as the final inversion image output.

5. The three-stage gradient inversion attack method based on variational autoencoder according to claim 4, characterized in that, Both the decoder D and the encoder E are derived from a stable diffusion model pre-trained on a public dataset. They are not retrained for the target dataset, resulting in a plug-and-play cross-dataset attack method.

6. The three-stage gradient inversion attack method based on variational autoencoder according to claim 5, characterized in that, The gradient matching loss is calculated based on the cosine similarity between the virtual gradient and the real gradient, and combined with the regularization terms corresponding to each stage to optimize image features in different dimensions: in step S1, structural information is restored; in step S2, texture and color are optimized; and in step S3, structural deviations are corrected.

7. The three-stage gradient inversion attack method based on variational autoencoder according to claim 6, characterized in that, The precise label y is derived based on gradient analysis and does not rely on prior knowledge of the target dataset.

8. A three-stage gradient inversion attack system based on a variational autoencoder, applicable to the three-stage gradient inversion attack method based on a variational autoencoder as described in any one of claims 1 to 7, characterized in that, Includes the following: The latent space search module, containing a decoder D, is used to map the initialized latent space encoding to semantic priors; A pixel space search module, connected to the potential space module, is used for iterative optimization of the image in the pixel space; A parameter space search module, connected to the pixel space search module, includes an encoder E and a decoder D with frozen weights, used to correct image structure deviations by fine-tuning the encoder weights of the encoder E.

9. The three-stage gradient inversion attack system based on variational autoencoder according to claim 8, characterized in that, Both the encoder E and the decoder D are derived from pre-trained generative models. They are not pre-trained or fine-tuned for specific task datasets, but are applied to target samples with different data distributions.

10. The three-stage gradient inversion attack system based on variational autoencoder according to claim 9, characterized in that, In a federated learning scenario, gradient update values ​​are taken as input, and the reconstructed original training samples are output to assess the privacy leakage risk under the federated learning framework.

Images