Abstract
Federated learning (FL) allows multiple entities to train a shared model collaboratively. Its core, privacy-preserving principle is that participants only exchange model updates, such as gradients, and never their raw, sensitive data. This approach is fundamental for applications in domains where privacy and confidentiality are important. However, the security of this very mechanism is threatened by gradient inversion attacks, which can reverse-engineer private training data directly from the shared gradients, defeating the purpose of FL. While the impact of these attacks is known for image, text, and tabular data, their effect on video data remains an unexamined area of research. This paper presents the first analysis of video data leakage in FL using gradient inversion attacks. We evaluate two common video classification approaches: one employing pre-trained feature extractors and another that processes raw video frames with simple transformations. Our initial results indicate that the use of feature extractors offers greater resilience against gradient inversion attacks. We also demonstrate that image super-resolution techniques can enhance the frames extracted through gradient inversion attacks, enabling attackers to reconstruct higher-quality videos. Our experiments validate this across scenarios where the attacker has access to zero, one, or more reference frames from the target environment. We find that although feature extractors make attacks more challenging, leakage is still possible if the classifier lacks sufficient complexity. We, therefore, conclude that video data leakage in FL is a viable threat, and the conditions under which it occurs warrant further investigation.
Abstract (translated)
联邦学习（FL）允许多个实体协作训练一个共享模型。其核心的隐私保护原则是参与者之间仅交换模型更新，例如梯度信息，而不分享原始敏感数据。这种做法对于需要严格保障隐私和保密性的领域至关重要。然而，这种机制的安全性受到了梯度逆向攻击的威胁，此类攻击可以直接从共享梯度中反演私人训练数据，从而破坏了FL的目的。尽管人们已经了解这些攻击对图像、文本和表格数据的影响，但它们对视频数据的效果仍然是一个尚未被探索的研究领域。 本文首次分析了在联邦学习环境下使用梯度逆向攻击导致的视频数据泄露问题。我们评估了两种常见的视频分类方法：一种采用预训练特征提取器的方法，另一种则是直接处理原始视频帧并通过简单变换进行处理的方式。我们的初步结果表明，使用特征提取器能够提供更强的抗梯度逆向攻击的能力。此外，我们还展示了图像超分辨率技术可以增强通过梯度逆向攻击获取到的视频帧，使攻击者能够重建更高质量的视频片段。 在实验中，无论是在攻击者拥有零个、一个还是多个目标环境中的参考帧的情况下，我们都验证了上述发现。研究结果表明，虽然特征提取器能增加攻击难度，但如果分类器复杂性不足，则仍然可能存在数据泄露的风险。因此，我们得出结论，在联邦学习环境中视频数据的泄漏确实是一种可行的安全威胁，并且需要进一步探索这种威胁发生的具体条件。
URL
https://arxiv.org/abs/2509.09742
