# Gradient Inversion of Federated Diffusion Models

Jiyue Huang, Chi Hong
Delft University of Technology
Delft, Netherlands
<EMAIL_ADDRESS>
<EMAIL_ADDRESS>
&Lydia Y. Chen
University of Neuchatel
Neuchatel, Switzerland
<EMAIL_ADDRESS>
&Stefanie Roos
RPTU Kaiserslautern
Kaiserslautern, Germany
<EMAIL_ADDRESS>

###### Abstract

Diffusion models are becoming defector generative models, which generate
exceptionally high-resolution image data. Training effective diffusion models
require massive real data, which is privately owned by distributed parties.
Each data party can collaboratively train diffusion models in a federated
learning manner by sharing gradients instead of the raw data. In this paper,
we study the privacy leakage risk of gradient inversion attacks. First, we
design a two-phase fusion optimization, GIDM, to leverage the well-trained
generative model itself as prior knowledge to constrain the inversion search
(latent) space, followed by pixel-wise fine-tuning. GIDM is shown to be able
to reconstruct images almost identical to the original ones. Considering a
more privacy-preserving training scenario, we then argue that locally
initialized private training noise $\boldsymbol{\epsilon}$ and sampling step
$t$ may raise additional challenges for the inversion attack. To solve this,
we propose a triple-optimization GIDM+ that coordinates the optimization of
the unknown data, $\boldsymbol{\epsilon}$ and $t$. Our extensive evaluation
results demonstrate the vulnerability of sharing gradient for data protection
of diffusion models, even high-resolution images can be reconstructed with
high quality.

##  1 Introduction

The emergence of likelihood-based diffusion models empowers probabilistic
models to generate high-quality data, especially for stable high-resolution
image and video data [16, 6, 13].

Figure 1: Original training image (left) v.s. Recover images (right) by
gradient inversion of diffusion models.

Diffusion models are trained by finding the reverse Markov transitions that
maximize the likelihood of the training data. In practice, the training is
done by gradually adding noise to and denoising the images for multiple steps.

However, training high-quality diffusion models usually requires a large
number of data. Practically, such data may be owned by different private
parties. Following data privacy regularization such as HIPAA and GDPR, data
owners may keep their data private rather than share it with a central server
for collection. In order to prevent direct local private data collecting but
share the knowledge, we are interested in whether the training of diffusion
models can be designed by collaborative training without sharing raw data.
Thanks to the design of DDPM at each round, which independently samples a
random Gaussian noise $\boldsymbol{\epsilon}$ and a sampling step $t$ to train
by approximate noise, we argue that this standard diffusion training paradigm
can be translated into the federated learning framework. Specifically, at each
global round of training, multiple distributed data owners (clients) train the
diffusion sub-models based on their local data. Then, the central server,
which connects to every client, aggregates their gradients before sending the
gradient back until convergence.

Such a federated training method successfully avoids direct data sharing but
opens a door for the server to obtain the intermediate training gradients and
the diffusion model in the end. While studies on federated training
classifiers demonstrate that the server is able to invert the client’s raw
data from their intermediate gradients, it is unknown how gradient information
also leaks information of the training data in federated diffusion training.
Moreover, the well-trained also leak privacy information [3, 8, 15, 2]. For
example, relying on information estimation of the trained model, e.g., error
comparison of the forward process posterior estimation [3], adversaries are
able to launch membership inference attacks [8, 3, 18]. Further, recent
studies reveal that trained diffusion models are able to re-create samples
that resemble the training data style [15].

In this paper, we systematically study the data reconstruction risk when
training federated diffusion models. We first define the federated training
method for diffusion models. Applying the existing inversion attacks for
federated classifiers training on diffusion models falls short due to a wide
search space of inversion. As the adversarial naturally owns the trained
diffusion model and the prior studies [9, 4] show the advantage of including
trained generative models, e.g., Generative Adversarial Networks, to improve
the reconstruction quality by constraining the searching space of dummy data,
we thus advocate to leverage such prior knowledge. Accordingly, we design a
fusion optimization, GIDM, that includes two training phases. The generating
phase maps the dummy data training into a narrow latent space to optimize in-
distribution images by adding the diffusion model as prior knowledge. Then the
fine-tuning phase further optimizes the similarity between the dummy and real
gradients to update the dummy data generated by the generating phase. Our
proposed GIDM is able to recover high-resolution images of $128\times 128$
almost identical to the origin, as shown by Fig. 1, where uncertainty by
searching space increases exponentially with increased pixel size.

Furthermore, we consider a more challenging, privacy-preserving training
scenario in which the data owner samples an arbitrary timestep $t$ and
initializes $\epsilon$ privately and locally, i.e., the honest-but-curious
server is unaware of. To solve this, we then propose the novel triple
optimization GIDM+ for dummy data, $\epsilon$ and $t$. Specifically, the
triple optimization includes three independent optimizers for the large-tensor
dummy data, $\boldsymbol{\epsilon}$ following Gaussian distribution for
initialization, and the integral $t$ with long range to refine the joint
training. By coordinating the optimization of them with updating intervals, we
are able to recover images without confidently knowing $\epsilon$ and $t$.

We summarize our main contribution as follows:

  * •

We are the first study on the gradient inversion attack for private training
data of federated diffusion models.

  * •

We design a two-phase fusion optimization GIDM that effectively inverts the
client gradients into images by leveraging the prior knowledge of trained
diffusion models. GIDM is able to re-create almost identical images of the
training data for size $128\times 128$.

  * •

To further tackle the more privacy-preserving scenario when $\epsilon$ and $t$
are private to clients, we design a triple optimization GIDM+ that
simultaneously inverts clients’ images, and private training parameters.

##  2 Related Work

Diffusion Models and Privacy. Diffusion models employ a two-step process:
initially deconstructing the training data structure step by step in a forward
manner, then mastering the reconstruction of the structure from noise in a
reverse process. The Denoising Diffusion Probabilistic Model (DDPM) [6]
introduced the stable and efficient implementation for high-quality image
synthesis. It is achieved via a forward process without learnable parameters
while employing simplified Gaussian noise in the reverse phase. Further
variants of diffusion models such as DDIM [16], Stable Diffusion [13], and
Imagen [14] thus improve the sampling efficiency or involve deep language
understanding for text-to-image generation. However, The well-trained
diffusion model network have been shown to be vulnerable to privacy attacks,
i.e., training data information leakage. Recent studies on privacy concerns of
diffusion models mainly focus on membership inference [3, 8, 18] attacks or
training data memorizing attacks [15, 2] from the trained model. None of the
studies has addressed the privacy leakage impact from the gradients of
diffusion models.

Gradient Inversion. As the first practical gradient inversion attack for
classifiers, Deep leakage from Gradients (DLG) reconstructs data and label
simultaneously by directly approximating gradients from the dummy data input
[25]. Two main aspects that DLG suffers from are reconstructed data quality
and the inability to deal with large training batches. To strengthen DLG, one
line of work improves DLG by developing different optimizer [20, 5], distance
measure metrics [5], or integrating direct features [24] by the network, e.g.,
they first infer labels before reconstructing. The other line of work focuses
on bringing external knowledge for inversion. Such knowledge includes knowing
prior data distributions for more accurate embedding, adding a batch
normalization regularizer to manage larger reconstructing batches [21],
applying pre-trained generator model to ensure high-quality output of
reconstructed data [9, 4, 11] or even utilizing auxiliary dataset. Besides
classification models, although generative models assist the inversion in
general, inversion also appears in Generative Adversarial Networks (GANs),
which aim to invert a given image back into the latent space of a pre-trained
GANs model [19]. Currently, there is no inversion attack studied for diffusion
models, namely reconstructing the input data from the intermediate gradients
of the federated diffusion model training.

##  3 Methodology

In this section, we first define a federated diffusion training method that
enables distributed learning without sharing data partition We then define and
propose a gradient inversion attack for federated diffusion models, which
composes two core optimization algorithms. The first algorithm is a
constrained inversion attack, focusing on a scenario where all training
hyperparameters are identical across clients. It specifically leverages prior
knowledge of pretrained diffusion models to narrow down the inversion
searching space. The second algorithm considers a privacy-preserving federated
method that two key hyperparameters of diffusion model training,
$\\{\boldsymbol{\epsilon},t\\}$, are sampled privately by local clients. We
thus propose a triple optimization algorithm, which optimizes and reconstrcuts
client data, and $\\{\boldsymbol{\epsilon},t\\}$ simultaneously.

###  3.1 Federated diffusion models

Algorithm 1 Federated Diffusion Model Training

Input: The number of clients $K$, number of global training round $R$, local
datasets $X_{k},k\in[1,K]$, diffusion steps $T$, global learning rate $\eta$.

Initialize model $\theta$
for  _$r=1,2,...,R$_ do

for  _$k=1,2,...,K$_ do

$t\sim\text{Uniform}(\\{1,...,T\\})$ // Excuted by the server
$\boldsymbol{\epsilon}\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I})$ //
Excuted by the server
$\boldsymbol{x}_{0}\sim X_{k}$ // Excuted by the client
Calculate
$g_{k}=\nabla_{\theta_{k}}\left\|\boldsymbol{\epsilon}_{k}-\boldsymbol{\epsilon}_{\theta_{k}}\left(\sqrt{\bar{\alpha}_{t}}\mathbf{x}_{0}+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon}_{k},t\right)\right\|^{2}$
// Excuted by the client

$g=\sum_{k=1}^{K}{g_{k}}$ // Excuted by the server
Update $\theta=\theta-\eta g$ // Excuted by the server

Return $\theta$
Result: The trained $\theta^{*}$

We consider a federated image generative task following the standard DDPM-like
diffusion model [6], which aims at optimizing weighted variational bound:

$L(\theta)=\mathbb{E}_{t,\mathbf{x}_{0},\boldsymbol{\epsilon}}\left[\left\|\boldsymbol{\epsilon}-\boldsymbol{\epsilon}_{\theta}\left(\sqrt{\bar{\alpha}_{t}}\mathbf{x}_{0}+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon},t\right)\right\|^{2}\right],$
(1)

where $\boldsymbol{x}_{0}\in\mathbb{R}^{m\times B}$ is the image training
samples (batch size $B$) of
$m=(\text{width})\times(\text{height})\times(\text{color})$, $L(\cdot)$ is the
point-wise loss function, $\theta$ denotes the diffusion model network
parameters and $\bar{\alpha}_{t}$ is hyper-parameter controlling the forward
noising process.Note that the sampling step $t$ is uniform between 1 and $T$
and we follow the definition [6] that $\boldsymbol{\epsilon}_{\theta}$ is a
function approximator intended to predict the added Gaussian noise
$\boldsymbol{\epsilon}$ to the image of step $t$, $\boldsymbol{x}_{t}$.

There are $K$ clients serving as data owners and are responsible for diffusion
model training. The $k^{th}$ federated learning client owns the local real
dataset $X_{k},k\in\\{1,2,...,K\\}$, which is not shared with others. Each
client reports the gradient of
$\nabla_{\theta}\left\|\boldsymbol{\epsilon}_{k}-\boldsymbol{\epsilon}_{\theta_{k}}\left(\sqrt{\bar{\alpha}_{t}}\mathbf{x}_{0}+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon}_{k},t\right)\right\|^{2}$
for the sampled data $\boldsymbol{x}_{0}$ sampled locally. We introduce a $R$
global training round of training. The single server $\mathcal{S}$, which does
not own any data itself, aggregates and distributes the gradient on each
global training round.

One canonical difference between federated diffusion and other models, e.g.,
classification tasks, lies in which party is supposed to sample $\epsilon$ and
$t$ for a given $\boldsymbol{x}_{0}$. Specifically, it can be either the
client that samples $\\{\epsilon,t\\}$ locally and privately for training each
batch, or the server, which samples $\\{\epsilon,t\\}$ and sends them to each
client per round per batch together with the aggregated model. Both settings
can be implemented as equivalent optimization problems of centralized
diffusion models. We consider two scenarios regarding whether the information
of $\\{\epsilon,t\\}$ is kept as clients’ private information. In the first
scenario, $\\{\epsilon,t\\}$ are sampled by the honest-and-curious server and
send them to each client per batch training. Given the global model learning
rate as $\eta$, the training of the federated diffusion model is equivalent to
the centralized DDPM and is illustrated in Alg. 1. Then, we extend to the
scenario where $\\{\epsilon,t\\}$ are kept privately.

###  3.2 GIDM: Constrained gradient inversion attack by diffusion prior

To study the privacy leakage risk of the federated diffusion based on
gradients, we propose a gradient inversion attack. The honest-but-curious
server reconstructs the victim client’s data using the gradients submitted by
the client and known values of $\epsilon$ and $t$. Our detailed description of
the threat model is included in Appendix. LABEL:app:threat. We model the
inversion process as an optimization problem that iteratively optimizes the
dummy data by minimizing the distance between known and approximate gradients,
as proposed by the inversion attacks for federated classifier training [25].
Following Alg. 1, when client $k$ computes the gradient by a batch of data
$\boldsymbol{x}_{0}=\\{x_{1},x_{2},...,x_{B}\\}$ with batch size $B$, the
gradient is formulated as
$g_{k}=\frac{1}{B}\sum_{i=1}^{B}\nabla_{\theta_{k}}\left\|\boldsymbol{\epsilon}_{k}-\boldsymbol{\epsilon}_{\theta_{k}}\left(\sqrt{\bar{\alpha}_{t}}x_{i}+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon}_{k},t\right)\right\|^{2}$.
Note that since a gradient inversion attack can be launched at any specific
global training round for any client, we ignore the $r$ round and $k$ client
indexes in the following section. Assuming that $\theta$ is second-order
differentiable, we suppose that dummy data $\hat{\boldsymbol{x}}_{0}$ is the
replica of $\boldsymbol{x}_{0}$ if $\hat{g}\sim g$, where $\hat{g}$ is the
dummy gradient calculated based on dummy $\hat{\boldsymbol{x}}_{0}$. Thus, our
gradient inversion objective turns to:

$\min_{\hat{x}_{1},...,\hat{x}_{B}}{D}(\frac{1}{B}\sum_{i=1}^{B}\nabla_{\theta}\left\|\boldsymbol{\epsilon}-\boldsymbol{\epsilon}_{\theta}\left(\sqrt{\bar{\alpha}_{t}}\hat{x}_{i}+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon},t\right)\right\|^{2},g)$
(2)

where ${D}(\cdot)$ is the distance measure metric for two gradients to show
similarity. We define $D(\cdot)$ by L2-Norm [25] distance.

Figure 2: Gradient inversion on diffusion models with constrained space by the
trained diffusion models. We utilize one $128\times 128$ figure from CelebA
dataset as an example to show every intermediate result above. The fusion
optimization includes two phases: the generative phase (8000 iterations on
this example) and the fine-tuning phase (1500 iterations), to reconstruct with
efficiency and effectiveness. The output of the generative phase differs from
the original data by hair, face, and background.

We first conduct an exploratory experiment on whether the direct translation
from the inversion method of the classifier can launch a successful gradient
inversion attack on diffusion models. The result presented in Sec. 4.1
demonstrates their inability to recover training samples. The reason behind
this lies in the wide search space of the optimization procedure. Also, the
difficulty of inversion in terms of randomness increases greatly with high-
resolution data.

To improve the optimization for high-resolution data, we propose a constrained
fusion optimization to leverage prior knowledge of the trained diffusion
model, $\mathcal{D}_{\theta}^{*}:\mathbb{R}^{m}\rightarrow\mathbb{R}^{m}$,
where $\theta^{*}$ is the diffusion model parameter. Our assumption is that
the server naturally possesses the trained diffusion model. Integrating the
knowledge of such a trained diffusion model brings the advantage of
constraining the searching space in optimizing the dummy data. Our proposed
fusion optimization consists of two phases: the generative phase and the fine-
tuning phase.

Generative phase. We aim to generate images that resemble the training dataset
as the starting point of dummy data optimization by gradient approximation. It
is achieved by mapping the original search into a narrow latent space with
constraints (or prior knowledge). Let the latent code
$\hat{\boldsymbol{x}}^{\prime}_{0}$ be the same dimension of the dummy data
$\hat{\boldsymbol{x}}_{0}$ from Eq. 2 and
$\hat{\boldsymbol{x}}_{0}=\mathcal{D}_{\theta}(\hat{\boldsymbol{x}}^{\prime}_{0},t)$,
we execute to optimize $\hat{\boldsymbol{x}}^{\prime}_{0}$ multiple iterations
so that the gradient computed on $\hat{\boldsymbol{x}}_{0}$ has a small
distance with the real gradient. By this means, instead of directly updating
the dummy data, we perform latent space search over
$\boldsymbol{\hat{x}}^{\prime}_{0}$, which is the input of
$\mathcal{D}_{\theta}$, outputting $\boldsymbol{\hat{x}}_{0}$. That is:
$\boldsymbol{\hat{x}}_{0}^{\prime,*}=\mathcal{D}_{\theta}(\left.\operatorname*{arg\,min}_{\hat{\boldsymbol{x}}^{\prime}_{0}}D(\left.\nabla_{\theta}\left\|\boldsymbol{\epsilon}-\boldsymbol{\epsilon}_{\theta}\left(\sqrt{\bar{\alpha}_{t}}\mathcal{D}_{\theta}(\hat{\boldsymbol{x}}^{\prime}_{0},t)+\sqrt{1-\bar{\alpha}_{t}}\boldsymbol{\epsilon},t\right)\right\|^{2},g\right),t\right)$.

Fine-tuning phase.  The generative phase is able to generate high-quality
data, whereas indirectly optimizing $\hat{\boldsymbol{x}}_{0}$ does not
guarantee pixel-wise similarity. On the other hand, each iteration of
optimizing the latent code $\hat{\boldsymbol{x}}^{\prime}_{0}$ requires $T$
sampling steps of the trained diffusion model, e.g., $T=1000$ in DDPM, which
is computationally intensive. Therefore, our fine-tuning phase executes direct
optimizing of $\hat{\boldsymbol{x}}_{0}$ following Eq. 2 based on the output
of the generative phase $\boldsymbol{\hat{x}}_{0}^{\prime,*}$ to increase the
pixel-wise similarity.

Our method is illustrated in Fig. 2. The output of the generative phase, i.e.,
the intermediate dummy data, generated by the optimized latent code
$\boldsymbol{\hat{x}}_{0}^{\prime,*}$, is then optimized by the fine-tuning
phase. From Fig. 2 we see that the generative phase is already able to
reconstruct a high-quality image of resembled style while the pixel-wise
similarity with the original data is low. By integrating the generative phase
and the fine-tuning phase, we recover high-resolution data efficiently and
effectively.

###  3.3 GIDM+: Triple-optimization for private $\epsilon$ and $t$

We now consider the federated diffusion training that both Gaussian noise and
sampling step are private information that are only known by the clients. To
implement the inversion without knowing $\\{\boldsymbol{\epsilon},t\\}$, we
need to optimize them three simultaneously while considering their design
principles and differences. In this part, we design a triple-optimization
method to refine the coordination of the three independent optimizations,
namely, $\boldsymbol{x}_{0}$, $\epsilon$, and $t$. Note that all of their
optimizations are based on backpropagating for approximating the gradients.

Optimizing $\hat{\boldsymbol{\epsilon}}$. In DDPM, we compute the distribution
of the noisy sample after $t$ iterations of the forward process in closed-form
by
$q\left(\mathbf{x}_{t}\mid\mathbf{x}_{0}\right)=\mathcal{N}\left(\mathbf{x}_{t};\sqrt{\bar{\alpha}_{t}}\mathbf{x}_{0},\left(1-\bar{\alpha}_{t}\right)\mathbf{I}\right)$.
The number of iterations in the forward process is set to a large $T$ , and
the variance levels
$\beta_{t}\in(0,1),\bar{\alpha}_{t}=\prod_{i=1}^{t}\left(1-\beta_{t}\right)$
increase linearly (ranging from $10^{-4}$ to $0.02$), which means that
$\bar{\alpha}_{t}\rightarrow 0$, and the latent distribution is a Gaussian
distribution $\epsilon$ sampled locally by the client should follow Gaussian
distribution
$\boldsymbol{\epsilon}\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I})$. When
implementing stochastic gradient descent, it requires a small learning rate
$\eta_{\epsilon}$ to update $\boldsymbol{\hat{\epsilon}}$. Following Eq. 1,
training diffusion models is to predict noises added in the forward process
and performs well with a stable noise. Thus, we utilize an interval updating
strategy that after $S$ iterations of updating $\boldsymbol{x}_{0}$ and $t$,
we perform $S$ iterations of $\boldsymbol{\hat{\epsilon}}$,
$\boldsymbol{x}_{0}$ and $t$ simultaneously:
$\boldsymbol{\hat{\epsilon}}^{i+1}=\boldsymbol{\hat{\epsilon}}^{i}-\eta_{\epsilon}\frac{\partial
D(\hat{g},g)}{\partial\boldsymbol{\hat{\epsilon}}^{i}},\,s.t.i\%2S>S.$

Optimizing $t$. Different from $\boldsymbol{\epsilon}$ and
$\boldsymbol{x}_{0}$, which are floating tensors, $t$ is an integer ranging
from $[1,T]$. To find the optimal discrete $t$ by stochastic gradient descent,
we define and initialize a $1\times T$ auxiliary vector following uniform
distribution:
$\boldsymbol{\hat{t}}\sim\text{Uniform}(\boldsymbol{0},\boldsymbol{J})$. Each
iteration of optimization by approximating dummy gradient to real gradient,
$\boldsymbol{\hat{t}}$ is updated by learning rate $\eta_{t}$. The inferred
$\hat{t}$ is designed as the index of the maximum element in the vector after
softmax transition:
$\hat{t}=\operatorname*{arg\,max}(softmax(\boldsymbol{\hat{t}}))$. $\hat{t}$
is updated at each inversion iteration:
$\hat{t}^{i+1}=\hat{t}^{i}-\eta_{t}\frac{\partial
D(\hat{g},g)}{\partial\hat{t}^{i}}.$

Optimizing $\boldsymbol{\hat{x}}_{0}$. Based on the dummy
$\boldsymbol{\hat{\epsilon}}$ and $\hat{t}$ as $\boldsymbol{\epsilon}$ and $t$
Eq. 2, performing the optimization of $\hat{\boldsymbol{x}}_{0}$ starts with a
random initialized image
$\hat{\boldsymbol{x}}_{0}\sim\text{Uniform}(\boldsymbol{0},2^{p}\boldsymbol{I})$,
given that the source data is a $p$-bit binary encoded value. With each
iteration, we update $\hat{\boldsymbol{x}}_{0}$ by back-propagating the
distance between $\hat{g}$ and $g$. We set the learning rate of the dummy data
as $\eta_{x}$. $\boldsymbol{x}_{0}$ is updated at each inversion iteration:
$\hat{t}$ is updated at each inversion iteration:
$\hat{\boldsymbol{x}}_{0}^{i+1}=\hat{\boldsymbol{x}}_{0}^{i}-\eta_{t}\frac{\partial
D(\hat{g},g)}{\partial\hat{\boldsymbol{x}}_{0}^{i}}.$ For all three
optimizations, we use Adam as the optimizer.

In summary, the triple-optimization gradient inversion coordinates three
independent optimization process to perform data reconstruction on more
privacy-preserving federated diffusion models.

##  4 Experiment

Setups. Unless stated otherwise, our experiments are implemented on two
datasets for the scenario when the adversarial server knows
$\\{\boldsymbol{\epsilon},t\\}$: Celeb-A [12]and LSUN-Bedroom [22], both with
image size resized to $128\times 128$. Both datasets are trained using the
standard DDPM model [6] as by Alg. 1 with 50 rounds. For the challenging case
when $\\{\boldsymbol{\epsilon},t\\}$ are private to clients, we use Cifar-100
[10] dataset with image size $32\times 32$. The optimization interval of GIDM+
for $\boldsymbol{\epsilon}$ optimizer is set to be 50. For measuring the image
similarity between the recovered data and the original, we use four evaluation
metrics: MSE [1], PSNR [7], SSIM [17], and LPIPS [23]. The detailed setups and
datasets are presented in Appendix. LABEL:app:setup and the description of our
evaluation metrics in Appendix. LABEL:app:metric.

Baselines. Since we are the first to study the gradient inversion attack on
diffusion models, there is no direct baseline to compare with. Most inversion
methods are designed for classifiers. Thus, we compare our data reconstructing
results with adapted versions of the attacks that are compatible with
diffusion models with single batch size: DLG-dm [25] and InvG-dm [5] with Adam
optimizer. The details on how to translate DLG and InvG for classifiers to
DLG-dm and InvG-dm for diffusion models are explained in Appendix.
LABEL:app:setup.

###  4.1 Final reconstructed images

To demonstrate our inversion effectiveness, we report the final MSE, LPIPS,
PSNR, SSIM results in Tab. 1 (when the server initializes
$\\{\boldsymbol{\epsilon},t\\}$) and Tab. 2 (when the client keep them private
locally). We also visualize the final reconstructed image examples in Fig. 3
for CelebA and LSUN-bedroom reconstruction. $\downarrow$ stands for the lower
the better while $\uparrow$ stands for the higher the better quality of
reconstruction based on the metric definitions. We discuss both the case when
$\\{\boldsymbol{\epsilon},t\\}$ is initialized by the server and when it is
privately initialized by the client. When $\\{\boldsymbol{\epsilon},t\\}$ is
sampled by the client, we assume that the baseline methods randomly initialize
them:
$\hat{\boldsymbol{\epsilon}}\sim\mathcal{N}(\boldsymbol{0},\boldsymbol{I})$
and $\hat{t}\sim\text{Uniform}(\\{1,...,T\\})$. “Generative” in Tab. 1 refers
to the output of the generative phase before the fine-tuning phase, reported
as an ablation study of our GIDM.

We start with the case when the server initializes
$\\{\boldsymbol{\epsilon},t\\}$. From the Tab. 1, it is evident that GIDM
outperforms baseline methods significantly over four different evaluation
metrics, demonstrating superior reconstructing results. DLG-dm and InvG-dm
have different loss functions in terms of measuring the similarity between the
dummy gradients and the real. Another point worth mentioning is that the
output of our generative phase does not always recover better images than DLG-
dm and InvG-dm. It can be explained by the fact that our four evaluation
metrics compute the quality of similarity based on pixels. “Generative”
optimizes the latent space to conduct indirect inversion. Thus, the high-
quality output (semantically similar and clear) from the diffusion model may
result in lower pixel-wise similarity than baselines, which is even blurred by
Fig. 3.

Table 1: Results for inversion of diffusion models on CelebA and LSUN-Bedroom datasets with $\\{\boldsymbol{\epsilon},t\\}$ initialized by the server. We compare our GIDM with the baseline methods adapted to diffusion inversion for two initialization scenarios. Dataset | Method |  MSE $\downarrow$ |  LPIPS $\downarrow$ |  PSNR $\uparrow$ |  SSIM $\uparrow$
---|---|---|---|---|---
CelebA | DLG-dm | 1.59e-2 | 0.67 | 66.12 | 0.39
InvG-dm | 0.04 | 0.75 | 62.43 | 0.30
Generative (ours) | 5.99e-3 | 0.11 | 70.36 | 0.71
GIDM (ours) | 7.31e-4 | 0.04 | 79.49 | 0.91
LSUN-Bedroom | DLG-dm | 0.02 | 0.64 | 65.37 | 0.37
InvG-dm | 3.71e-2 | 0.73 | 62.43 | 0.26
Generative (ours) | 0.01 | 0.26 | 66.74 | 0.54
GIDM (ours) | 7.13e-5 | 3.44e-3 | 89.60 | 0.99
Figure 3: Visualization of recovered images comparing with baselines on CelebA
and LSUN-Bedroom datasets. Images reconstructed with server initializing
$\\{\boldsymbol{\epsilon},t\\}$ are $128\times 128$ while with the private
client initialization, $32\times 32$ images are successfully recovered.
“Generative” in the figure is the output of our generative phase before the
fine-tuning phase.

Fig. 3 visualizes and compares the recovered images on both datasets of size
$128\times 128$. GIDM successfully reconstructs high-resolution images from
the gradients that are nearly indistinguishable from the ground truth
perceptually. As a comparison, DLG-dm and InvG-dm, which are designed for
classifiers, fail to recover resembled images. Specifically, they are only
able to create images of similar color palettes as the original data without
recreating the original object, let alone high-resolution details. This is
within our expectations since they conduct pixel-wise optimization. Such a way
suffers from exponentially increased difficulty of searching given a larger
image size, even when $\\{\boldsymbol{\epsilon},t\\}$ are known by the
adversarial server.

When it comes to the difference between “Generative” and GIDM, we observe that
our generative phase with the assistance of diffusion prior knowledge can
already recover high-quality images. Generally, the main color, object
outline, and positions after the generative phase are almost identical to the
ground truth, though there are still minor differences in the details of the
images. For example, the face and hair shape, the background texture, or
sometimes the makeup color is different from the ground truth on the CelebA
human-facial dataset. On LSUN-bedroom, we can see more distinct differences in
objects such as door and lap. Motivated by this, our next step of the fine-
tuning phase adjusts the generated images by direct gradient approximation,
outputting GIDM results of successful reconstruction.

Next, we move to the case when $\\{\boldsymbol{\epsilon},t\\}$ is kept private
by the clients. As the classifier baselines DLG and InvG do not have the
intentional design for $\boldsymbol{\epsilon}$ and $t$, which is specified by
diffusion probabilistic models, we use unchanged Gaussian random
initialization for their $\boldsymbol{\epsilon}$ and uniformly sampled $t$
from $[1,T]$. The results on Cifar-10 datasets are presented in Tab. 2. From
the results, GIDM+ shows obvious superiority against DLG-dm and InvG-dm,
demonstrating the effectiveness of our design of triple-optimization, refining
three independent optimizers. Both baseline methods fail to reconstruct in
terms of the similarity measure metrics. We may explain this by the process
that the training of diffusion models defined by Eq. 1 predicts the sampled
noise for training each step. However, once the noise is kept confidential,
the random initialized noise by DLG-dm and InvG-dm, which is different from
the one from training, will lead to unsuccessful inversion due to totally
different optimization. For GIDM+, optimizing three independent optimizers
with intervals provides information to each other for coordination. However,
GIDM+ also finds it challenging when recover high-resolution images. We will
leave this to further work.

Table 2: Results for inversion of diffusion models on Cifar-10 datasets with $\\{\boldsymbol{\epsilon},t\\}$ initialized by the clients and is unknown to the adversary. We compare GIDM+ with the baseline methods adapted to diffusion inversion for two initialization scenarios. Method |  MSE $\downarrow$ |  LPIPS $\downarrow$ |  PSNR $\uparrow$ |  SSIM $\uparrow$
---|---|---|---|---
DLG-dm | 69.01 | 0.34 | 29.74 | 4.62e-3
InvG-dm | 1.30 | 0.32 | 47.00 | 0.25
GIDM+ (ours) | 0.36 | 0.14 | 52.61 | 0.54

To summarize, gradient inversion of diffusion models by integrating the
trained generator as prior knowledge to optimize the latent space greatly
constrained the search space of the high-resolution images, demonstrated by
generating high-quality data similar to the ground truth. However, such
indirect inversion by optimizing latent code while outputting images from the
generative model does not guarantee a small pixel-wise distance. Thus, a
followed fine-tuning phase that conducts direct pixel-wise optimization
according to approximate gradients further enhances the data reconstruction
attack, demonstrated by generated images that are visually nearly identical to
the original.

###  4.2 Intermediate inversion outputs on GIDM

Let us zoom into how the image is recovered by our proposed GIDM and bring
some insights on the vulnerability of federated diffusion models against
gradient inversion attacks. We use $128\times 128$ image example from LSUN-
Bedroom and CelebA dataset, illustrated in Fig. 4.

Figure 4: Step-by-step gradient inversion intermediate results visualization.
The generative phase is marked by yellow arrows while the fine-tuning phase is
red arrows. We initialize the latent code by $128\times 128$ Gaussian noise.
The generative phase is trained by 5000 iterations while the fine-tuning phase
by 2000 iterations. We present the evenly divided iterations through the whole
process.

From the figure, for the generative phase, the initialized random Gaussian
noise can output a decent image of a bedroom. Although it is exactly different
from the ground truth image, it has constrained the search space of dummy
optimization by the knowledge of the well-trained diffusion model. After
calculating the dummy gradient based on the previous bedroom image, our back-
propagation by approximating the dummy to the real gradient adjusts the
Gaussian noise so that it gradually generates an image of a similar color
palette and object outlines. One interesting finding is that the color turns
similar at a very early iteration while the object outlines converge slowly
and gradually, such as the hanging paintings. Upon reaching the 5000-th
iteration of the generative phase, the recovered image has been gradually
adjusting the details in the image. Yet, we have tried to increase the number
of iterations to 15000 and found the final image still cannot fully recover
the ground truth due to this indirect optimization process. The finding
motivates us to integrate direct updating. This is where our fine-tuning phase
comes into play.

The fine-tuning phase starts with the output of the generative phase and we
train 1800 iterations. Following the red arrows, the blanket, and hanging
paintings are turning to approximate the original data. The fine-tuning phase
does not utilize the diffusion model for optimizing alternative space. Thus,
the reconstruction is efficient due to unnecessarily executing diffusion model
sampling at each optimization iteration as the generative phase.

###  4.3 The impact of $t$ on GIDM+

Our results in Sec. 4.1 consider $\boldsymbol{\epsilon}$ and $t$ initialized
together by either the server or the client. Here we provide an ablation study
on the impact of knowing $t$. We have evaluated that it is difficult to
recover high-resolution images of high quality without knowing
$\boldsymbol{\epsilon}$ due to a high order of randomness brought by
predicting the high-dimensional noise. We use an image from CelebA as an
example and show the process of optimization in Fig. 5. From the steps, it can
be observed that when $t$ is known to the server, the optimization process is
smooth. This demonstrates that generating the changing $t$ as the input of
$\mathcal{D}(\hat{\boldsymbol{x}}_{0},t)$ influences the approximation during
the optimization process of $t$. However, even without knowing $t$, the
$128\times 128$ images can be recovered in the end due to the less randomness
than $\boldsymbol{\epsilon}$.

Figure 5: Step-by-step gradient inversion intermediate results visualization,
comparing known or unknown $t$. We initialize the latent code by $128\times
128$ Gaussian noise. We present some of the representative intermediate
outputs through the whole process. The total number of inversion iterations is
3000.

##  5 Conclusion

In this paper, we are the first to study gradient inversion attacks on
diffusion models. When the adversarial server knows the Gaussian noise and
sampling step for training, we propose GIDM to optimize the dummy image in a
generative phase followed by a fine-tuning phase. Our experiments demonstrate
the importance of both phases for recovering high-resolution data, allowing
for reconstruction when other attacks fails. For the challenging scenario when
noise and step are unknown, our proposed GIDM+ further integrates a triple
optimization process that coordinates three independent optimizers to conduct
optimizations with intervals. GIDM+ is able to invert image size of $32\times
32$, when all of the baselines fail.

## References

  * [1] Peter J Bickel and Kjell A Doksum.  Mathematical statistics: basic ideas and selected topics, volumes I-II package.  CRC Press, 2015.
  * [2] Nicholas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Sehwag, Florian Tramèr, Borja Balle, Daphne Ippolito, and Eric Wallace.  Extracting training data from diffusion models.  In Joseph A. Calandrino and Carmela Troncoso, editors, 32nd USENIX Security Symposium, USENIX Security 2023, Anaheim, CA, USA, August 9-11, 2023, pages 5253–5270. USENIX Association, 2023.
  * [3] Jinhao Duan, Fei Kong, Shiqi Wang, Xiaoshuang Shi, and Kaidi Xu.  Are diffusion models vulnerable to membership inference attacks?  In International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Honolulu, Hawaii, USA, volume 202 of Proceedings of Machine Learning Research, pages 8717–8730. PMLR, 2023.
  * [4] Hao Fang, Bin Chen, Xuan Wang, Zhi Wang, and Shu-Tao Xia.  GIFD: A generative gradient inversion method with feature domain optimization.  In IEEE/CVF International Conference on Computer Vision, ICCV 2023, Paris, France, October 1-6, 2023, pages 4944–4953. IEEE, 2023.
  * [5] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients - how easy is it to break privacy in federated learning?  In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
  * [6] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
  * [7] Alain Horé and Djemel Ziou.  Image quality metrics: PSNR vs. SSIM.  In 20th International Conference on Pattern Recognition, ICPR 2010, Istanbul, Turkey, 23-26 August 2010, pages 2366–2369. IEEE Computer Society, 2010.
  * [8] Hailong Hu and Jun Pang.  Loss and likelihood based membership inference of diffusion models.  In Elias Athanasopoulos and Bart Mennink, editors, Information Security - 26th International Conference, ISC 2023, Groningen, The Netherlands, November 15-17, 2023, Proceedings, volume 14411 of Lecture Notes in Computer Science, pages 121–141. Springer, 2023.
  * [9] Jinwoo Jeon, Jaechang Kim, Kangwook Lee, Sewoong Oh, and Jungseul Ok.  Gradient inversion with generative image prior.  In Marc’Aurelio Ranzato, Alina Beygelzimer, Yann N. Dauphin, Percy Liang, and Jennifer Wortman Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pages 29898–29908, 2021.
  * [10] Alex Krizhevsky, Geoffrey Hinton, et al.  Learning multiple layers of features from tiny images.  2009\.
  * [11] Zhuohang Li, Jiaxin Zhang, Luyang Liu, and Jian Liu.  Auditing privacy defenses in federated learning via generative gradient leakage.  In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pages 10122–10132. IEEE, 2022.
  * [12] Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang.  Deep learning face attributes in the wild.  In 2015 IEEE International Conference on Computer Vision, ICCV 2015, Santiago, Chile, December 7-13, 2015, pages 3730–3738. IEEE Computer Society, 2015.
  * [13] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2022, New Orleans, LA, USA, June 18-24, 2022, pages 10674–10685. IEEE, 2022.
  * [14] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L. Denton, Seyed Kamyar Seyed Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, Jonathan Ho, David J. Fleet, and Mohammad Norouzi.  Photorealistic text-to-image diffusion models with deep language understanding.  In Advances in Neural Information Processing Systems 35: Annual Conference on Neural Information Processing Systems 2022, NeurIPS 2022, New Orleans, LA, USA, November 28 - December 9, 2022, 2022.
  * [15] Gowthami Somepalli, Vasu Singla, Micah Goldblum, Jonas Geiping, and Tom Goldstein.  Diffusion art or digital forgery? investigating data replication in diffusion models.  In IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2023, Vancouver, BC, Canada, June 17-24, 2023, pages 6048–6058. IEEE, 2023.
  * [16] Jiaming Song, Chenlin Meng, and Stefano Ermon.  Denoising diffusion implicit models.  In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
  * [17] Zhou Wang, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli.  Image quality assessment: from error visibility to structural similarity.  IEEE Trans. Image Process., 13(4):600–612, 2004.
  * [18] Yixin Wu, Ning Yu, Zheng Li, Michael Backes, and Yang Zhang.  Membership inference attacks against text-to-image generation models.  CoRR, abs/2210.00968, 2022.
  * [19] Weihao Xia, Yulun Zhang, Yujiu Yang, Jing-Hao Xue, Bolei Zhou, and Ming-Hsuan Yang.  GAN inversion: A survey.  IEEE Trans. Pattern Anal. Mach. Intell., 45(3):3121–3138, 2023.
  * [20] Jin Xu, Chi Hong, Jiyue Huang, Lydia Y. Chen, and Jérémie Decouchant.  AGIC: approximate gradient inversion attack on federated learning.  In 41st International Symposium on Reliable Distributed Systems, SRDS 2022, Vienna, Austria, September 19-22, 2022, pages 12–22. IEEE, 2022.
  * [21] Hongxu Yin, Arun Mallya, Arash Vahdat, José M. Álvarez, Jan Kautz, and Pavlo Molchanov.  See through gradients: Image batch recovery via gradinversion.  In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2021, virtual, June 19-25, 2021, pages 16337–16346. Computer Vision Foundation / IEEE, 2021.
  * [22] Fisher Yu, Yinda Zhang, Shuran Song, Ari Seff, and Jianxiong Xiao.  LSUN: construction of a large-scale image dataset using deep learning with humans in the loop.  CoRR, abs/1506.03365, 2015.
  * [23] Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang.  The unreasonable effectiveness of deep features as a perceptual metric.  In 2018 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2018, Salt Lake City, UT, USA, June 18-22, 2018, pages 586–595. Computer Vision Foundation / IEEE Computer Society, 2018.
  * [24] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  CoRR, abs/2001.02610, 2020.
  * [25] Ligeng Zhu, Zhijian Liu, and Song Han.  Deep leakage from gradients.  In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada, pages 14747–14756, 2019.