arXivDaily arXiv每日学术速递 周一至周五更新
北美退伍军人节(Veterans Day),12 日无更新
arXiv 2104.07586cs.LGcs.CV
收藏

通过GradInversion实现图像批量恢复

See through Gradients: Image Batch Recovery via GradInversion

NVIDIA(英伟达)

Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M. Alvarez, Jan Kautz, Pavlo Molchanov

摘要:

训练深度神经网络需要从数据批次中进行梯度估计以更新参数。每个参数的权重是在一组数据上平均的,这被认为对于联合、协作和联邦学习应用中的隐私保护训练是安全的。以前的工作只显示了在非常严格的条件下恢复给定梯度的输入数据的可能性-单个输入点,或没有非线性的网络,或小的32 x32 px输入批次。因此,对较大批次的梯度求平均值被认为是安全的。在这项工作中,我们引入了GradInversion,使用它可以在ImageNet(1000个类,224 x224 px)等复杂数据集上为ResNets(50层)等大型网络恢复较大批次(8 - 48张图像)的输入图像。我们制定了一个优化任务,将随机噪声转换为自然图像,匹配梯度,同时正则化图像保真度。我们还提出了一个算法的目标类标签恢复给定的梯度。我们进一步提出了一个组一致性正则化框架,其中多个代理从不同的随机种子开始共同努力,找到一个增强的重建原始数据批次。我们发现梯度编码了惊人的大量信息,因此即使对于复杂的数据集,深度网络和大批量数据,也可以通过GradInversion以高保真度恢复所有单个图像。

英文摘要:

Training deep neural networks requires gradient estimation from data batches to update parameters. Gradients per parameter are averaged over a set of data and this has been presumed to be safe for privacy-preserving training in joint, collaborative, and federated learning applications. Prior work only showed the possibility of recovering input data given gradients under very restrictive conditions - a single input point, or a network with no non-linearities, or a small 32x32 px input batch. Therefore, averaging gradients over larger batches was thought to be safe. In this work, we introduce GradInversion, using which input images from a larger batch (8 - 48 images) can also be recovered for large networks such as ResNets (50 layers), on complex datasets such as ImageNet (1000 classes, 224x224 px). We formulate an optimization task that converts random noise into natural images, matching gradients while regularizing image fidelity. We also propose an algorithm for target class label recovery given gradients. We further propose a group consistency regularization framework, where multiple agents starting from different random seeds work together to find an enhanced reconstruction of original data batch. We show that gradients encode a surprisingly large amount of information, such that all the individual images can be recovered with high fidelity via GradInversion, even for complex datasets, deep networks, and large batch sizes.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑