  Federated learning (FL) emerged as a promising learning paradigm to enable a
multitude of participants to construct a joint ML model without exposing their
private training data. Existing FL designs have been shown to exhibit
vulnerabilities which can be exploited by adversaries both within and outside
of the system to compromise data privacy. However, most current works conduct
attacks by leveraging gradients on a small batch of data, which is less
practical in FL. In this work, we consider a more practical and interesting
scenario in which participants share their epoch-averaged gradients (share
gradients after at least 1 epoch of local training) rather than per-example or
small batch-averaged gradients as in previous works. We perform the first
systematic evaluation of attribute reconstruction attack (ARA) launched by the
malicious server in the FL system, and empirically demonstrate that the shared
epoch-averaged local model gradients can reveal sensitive attributes of local
training data of any victim participant. To achieve this goal, we develop a
more effective and efficient gradient matching based method called cos-matching
to reconstruct the training data attributes. We evaluate our attacks on a
variety of real-world datasets, scenarios, assumptions. Our experiments show
that our proposed method achieves better attribute attack performance than most
existing baselines.
