  Federated Learning (FL) framework brings privacy benefits to distributed
learning systems by allowing multiple clients to participate in a learning task
under the coordination of a central server without exchanging their private
data. However, recent studies have revealed that private information can still
be leaked through shared gradient information. To further protect user's
privacy, several defense mechanisms have been proposed to prevent privacy
leakage via gradient information degradation methods, such as using additive
noise or gradient compression before sharing it with the server. In this work,
we validate that the private training data can still be leaked under certain
defense settings with a new type of leakage, i.e., Generative Gradient Leakage
(GGL). Unlike existing methods that only rely on gradient information to
reconstruct data, our method leverages the latent space of generative
adversarial networks (GAN) learned from public image datasets as a prior to
compensate for the informational loss during gradient degradation. To address
the nonlinearity caused by the gradient operator and the GAN model, we explore
various gradient-free optimization methods (e.g., evolution strategies and
Bayesian optimization) and empirically show their superiority in reconstructing
high-quality images from gradients compared to gradient-based optimizers. We
hope the proposed method can serve as a tool for empirically measuring the
amount of privacy leakage to facilitate the design of more robust defense
mechanisms.
