SVDefense: Effective Defense against Gradient Inversion Attacks via Singular Value Decomposition

SVDefense: Effective Defense against Gradient Inversion Attacks via Singular Value Decomposition

Speakers: Chenxiang Luo

Conference: NDSS Symposium

YouTube: https://www.youtube.com/watch?v=adgKdQNVMTA

Overview

Federated learning promises privacy by keeping training data local and only sharing model gradients with the central server. However, gradient inversion attacks (GIA) can reconstruct raw user data from these uploaded gradients. Worse, this talk demonstrates that existing defenses against GIA -- including pruning, perturbation, and compression-based methods -- are vulnerable to adaptive attackers who know the defense details and can circumvent them. The researchers propose SVDefense, a novel defense based on truncated singular value decomposition (SVD) that irreversibly transforms all gradients while preserving model utility.

Presented by Professor Chenxiang Luo from City University of Hong Kong, the work introduces a defense that dynamically adjusts protection based on each client's degree of class imbalance (clients with more imbalanced data are more vulnerable to GIA). SVDefense outperforms all baselines against both standard and adaptive GIA attacks while maintaining competitive model accuracy, and was evaluated on embedded devices including NVIDIA Jetson TX2, Jetson Nano, and Raspberry Pi to demonstrate practical deployability.

Background

▶ Watch: Federated learning privacy and the gradient inversion attack threat (0:00)

Gradient Inversion Attacks (GIA) treat the reconstruction of private training data as an iterative optimization problem: the attacker minimizes the difference between the original (uploaded) gradients and dummy gradients computed from dummy inputs, iteratively refining the dummy inputs until they converge on the actual training data. The federated learning market is expected to grow to $297 million by 2030, making the privacy of gradient uploads a significant commercial concern.

Existing defenses fall into four categories: encryption-based methods (cryptographic protection with significant computational overhead), perturbation-based methods (modifying inputs, gradients, or the training process), pruning-based methods (selectively removing gradient components), and compression-based methods (reducing gradient information content). Each category has known weaknesses, but the critical gap identified in this work is vulnerability to adaptive attackers.

An adaptive attacker has obtained the defense details and actively adapts their attack to circumvent the specific defense in use. For example, against a pruning defense, an adaptive attacker detects which gradient values were zeroed out and applies the same pruning to their dummy gradients, effectively nullifying the defense.

Key Findings

▶ Watch: Adaptive attackers defeat pruning, perturbation, and sensor defenses (4:00)

The preliminary study reveals that all major defense categories fail against adaptive adversaries:

Pruning-based defenses: An adaptive attacker detects zero values in pruned gradients and applies identical pruning to dummy gradients, recovering attack effectiveness. Both standard and advanced pruning methods are defeated.

Random variable-based defenses: An adaptive attacker initializes a dummy random vector and optimizes it alongside dummy inputs during the attack process, effectively recovering the random perturbation.

Sensor-based defenses: A recent defense that perturbs gradients only during initial epochs is defeated by attacking in subsequent undefended epochs, where useful information for reconstruction can still be extracted. Continuously applying protection degrades model utility unacceptably.

The core insight behind SVDefense is that truncated SVD irreversibly affects all gradients -- unlike pruning (which leaves some gradients untouched) or random perturbation (which can be recovered), SVD decomposition with truncation permanently removes information that cannot be reconstructed even by an adaptive attacker who knows the exact defense mechanism.

A second key finding is that clients with higher degrees of class imbalance are more vulnerable to gradient inversion attacks, meaning uniform protection across all clients is suboptimal. SVDefense addresses this by using the entropy of squared singular values as a proxy for class imbalance, dynamically adjusting the energy threshold for each client.

Technical Deep Dive

▶ Watch: Truncated SVD: irreversible gradient transformation for privacy (8:00)

SVDefense operates in six steps across clients and the central server:

1. Local training: Clients train local models using private data
2. Channel-wise weighting: Each client computes channel-wise weights based on gradient magnitudes, preserving larger gradients (critical for model utility) while applying stronger perturbation to smaller gradients (which contain redundant information)
3. SVD with adaptive thresholding: Clients perform SVD on weighted gradients and calculate an entropy-based adaptive energy threshold. The entropy of squared singular values increases with class balance ratio, so more imbalanced clients get lower energy thresholds (stronger protection)
4. Gradient truncation: Gradients are truncated according to the client-specific threshold
5. Upload: Truncated gradients, weights, and entropy values are sent to the server
6. Robust aggregation: The server reconstructs gradients, computes aggregation weights (higher weights for more balanced clients), and updates the global model

The channel-wise weighted approximation is based on the finding that the top 20% largest gradients contain most of the information critical for model utility, while the bottom 80% contain more redundant information. By preserving larger gradients and applying stronger truncation to smaller ones, SVDefense achieves a better privacy-utility trade-off than uniform truncation.

The adaptive energy threshold calculation uses the relationship between singular value entropy and class imbalance: clients with more balanced data distributions (lower vulnerability) get higher energy thresholds (weaker protection to preserve utility), while highly imbalanced clients (higher vulnerability) get lower thresholds (stronger protection).

Demo / Proof of Concept

▶ Watch: Class imbalance vulnerability and entropy-based adaptive thresholding (10:00)

The evaluation covered three dataset categories: image classification, human activity recognition, and keyword spotting, demonstrating generality beyond computer vision. The test bed included a server and heterogeneous client devices: NVIDIA Jetson TX2, Jetson Nano, and Raspberry Pi models, reflecting realistic edge computing deployments.

Against the adaptive IG attack, SVDefense achieved the best defense performance compared to all baselines (bold in results tables). Against the stronger adaptive LTI attack, SVDefense maintained its advantage. Accuracy curves showed SVDefense (red curves) achieving competitive performance across communication rounds.

Ablation studies confirmed that the complete version of SVDefense outperforms ablated variants in both accuracy and defense performance, and achieves higher communication cost reduction at equivalent accuracy levels. Latency measurements on embedded devices showed minimal extra overhead, confirming practical deployability on resource-constrained hardware.

Defensive Implications

▶ Watch: Evaluation results: outperforming baselines on embedded devices (14:00)

SVDefense provides a practical, deployable defense for federated learning systems against the most realistic threat -- adaptive attackers who know the defense mechanism. Key advantages for defenders:

• Adaptive attacker resistance: Unlike pruning or perturbation defenses, truncated SVD is irreversible -- knowing the defense mechanism does not help the attacker recover the removed information
• Automatic vulnerability adaptation: The entropy-based thresholding automatically provides stronger protection to more vulnerable clients without requiring manual configuration
• Embedded device compatibility: Demonstrated on Jetson TX2, Jetson Nano, and Raspberry Pi with minimal latency overhead
• Channel-wise optimization: Preserving critical gradient information while truncating redundant components maintains model utility

Organizations deploying federated learning should evaluate whether their current GIA defenses are robust against adaptive attackers. The preliminary study in this paper provides a framework for testing: assume the attacker knows your defense and try to adapt around it. If your defense relies on pruning, perturbation, or epoch-limited protection, it is likely vulnerable.

Key Takeaways

• Existing gradient inversion attack defenses (pruning, perturbation, compression) all fail against adaptive attackers who know the defense mechanism
• Truncated SVD provides irreversible gradient transformation that resists adaptive attacks while preserving model utility
• Clients with higher class imbalance are more vulnerable to gradient inversion, requiring adaptive per-client protection levels
• Entropy of squared singular values serves as an effective proxy for class imbalance, enabling automatic threshold adaptation
• The top 20% of gradient magnitudes carry critical model utility information, while the bottom 80% can be aggressively truncated for privacy
• SVDefense is deployable on resource-constrained embedded devices (Jetson, Raspberry Pi) with minimal latency overhead

About the Speaker(s)

Chenxiang Luo is a professor at City University of Hong Kong, collaborating with student Chengang Luo (also CityU Hong Kong) and Professor David Yao from Singapore University of Technology and Design (SUTD). The speaker presented the work with clear technical depth, engaging with audience questions about the relationship between gradient uploads in FedAvg and the applicability of gradient inversion attacks to multi-epoch local training scenarios.