# Evaluating Gradient Inversion Attacks and Defenses in Federated Learning

Yangsibo Huang
Princeton University
Princeton, NJ 08540
<EMAIL_ADDRESS>
&Samyak Gupta
Princeton University
Princeton, NJ 08540
<EMAIL_ADDRESS>
&Zhao Song
Adobe Research
San Jose, CA 95110
<EMAIL_ADDRESS>
&Kai Li
Princeton University
Princeton, NJ 08540
<EMAIL_ADDRESS>
&Sanjeev Arora
Princeton University
Princeton, NJ 08540
<EMAIL_ADDRESS>

###### Abstract

Gradient inversion attack (or input recovery from gradient) is an emerging
threat to the security and privacy preservation of Federated learning, whereby
malicious eavesdroppers or participants in the protocol can recover
(partially) the clients’ private data. This paper evaluates existing attacks
and defenses. We find that some attacks make strong assumptions about the
setup. Relaxing such assumptions can substantially weaken these attacks. We
then evaluate the benefits of three proposed defense mechanisms against
gradient inversion attacks. We show the trade-offs of privacy leakage and data
utility of these defense methods, and find that combining them in an
appropriate manner makes the attack less effective, even under the original
strong assumptions. We also estimate the computation cost of end-to-end
recovery of a single image under each evaluated defense. Our findings suggest
that the state-of-the-art attacks can currently be defended against with minor
data utility loss, as summarized in a list of potential strategies. Our code
is available at: https://github.com/Princeton-SysML/GradAttack.

##  1 Introduction

Federated learning (McMahan et al., 2016; Kairouz et al., 2021) is a framework
that allows multiple clients in a distributed environment to collaboratively
train a neural network model at a central server, without moving their data to
the central server.

At every training step, each client computes a model update —i.e., gradient—
on its local data using the latest copy of the global model, and then sends
the gradient to the central server. The server aggregates these updates
(typically by averaging) to construct a global model, and then sends the new
model parameters to all clients. By allowing clients to participate in
training without directly sharing their data, such protocols align better with
data privacy regulations such as Health Insurance Portability and
Accountability Act (HIPPA) (Act, 1996), California Consumer Privacy Act (CCPA)
(Legislature, 2018), and General Data Protection Regulation (Commission,
2018).

While sharing gradients was thought to leak little information about the
client’s private data, recent papers (Zhu et al., 2019; Zhao et al., 2020;
Geiping et al., 2020; Yin et al., 2021) developed a “gradient inversion
attack” by which an attacker eavesdropping on a client’s communications with
the server can begin to reconstruct the client’s private data. The attacker
can also be a malicious participant in the Federated Learning scheme,
including a honest-but-curious server who wishes to reconstruct private data
of clients, or a honest-but-curious client who wishes to reconstruct private
data of other clients. These attacks have been shown to work with batch sizes
only up to $100$ but even so they have created doubts about the level of
privacy ensured in Federated Learning. The current paper seeks to evaluate the
risks and suggest ways to minimize them.

Several defenses against gradient inversion attacks have been proposed. These
include perturbing gradients (Zhu et al., 2019; Wei et al., 2020) and using
transformation for training data that clients can apply on the fly (Zhang et
al., 2018a; Huang et al., 2020). More traditional cryptographic ideas
including secure aggregation (Bonawitz et al., 2016) or homomorphic encryption
(Phong et al., 2018) for the gradients can also be used and presumably stop
any eavesdropping attacks completely. They will not be studied here due to
their special setups and overhead.

We are not aware of a prior systematic evaluation of the level of risk arising
from current attacks and the level of security provided by various defenses,
as well as the trade-off (if any) between test accuracy, computation overhead,
and privacy risks.

The paper makes two main contributions. First, we draw attention to two strong
assumptions that a current gradient inversion attack (Geiping et al., 2020)
implicitly makes. We show that by nullifying these assumptions, the
performance of the attack drops significantly and can only work for low-
resolution images. The findings are explored in Section 3 and already imply
some more secure configurations in Federated Learning (Section 6).

Second, we summarize various defenses (Section 4) and systematically evaluate
(Section 5) some of their performance of defending against a state-of-the-art
gradient inversion attack, and present their data utility and privacy leakage
trade-offs. We estimate the computation cost of end-to-end recovery of a
single image under each evaluated defense. We also experimentally demonstrate
the feasibility and effectiveness of combined defenses. Our findings are
summarized as strategies to further improve Federated Learning’s security
against gradient inversion attacks (Section 6).

In Appendix B, we provide theoretical insights for mechanism of each evaluated
defense.

##  2 Gradient Inversion Attacks

Previous studies have shown the feasibility of recovering input from gradient
(i.e. gradient inversion) for image classification tasks, by formulating it as
an optimization problem: given a neural network with parameters $\theta$, and
the gradient $\nabla_{\theta}\mathcal{L}_{\theta}(x^{*},y^{*})$ computed with
a private data batch $(x^{*},y^{*})\in\mathbb{R}^{b\times
d}\times\mathbb{R}^{b}$ ($b,d$ being the batch size, image size), the attacker
tries to recover $x\in\mathbb{R}^{b\times d}$, an approximation of $x^{*}$:

$\arg\min_{x}\mathcal{L}_{\rm
grad}(x;\theta,\nabla_{\theta}\mathcal{L}_{\theta}(x^{*},y^{*}))+\alpha\mathcal{R}_{\rm
aux}(x)$ (1)

The optimization goal consists of two parts: $\mathcal{L}_{\rm
grad}(x;\theta,\nabla_{\theta}\mathcal{L}_{\theta}(x^{*},y^{*}))$ enforces
matching of the gradient of recovered batch $x$ with the provided gradients
$\mathcal{L}_{\theta}(x^{*},y^{*})$, and $\mathcal{R}_{\rm aux}(x)$
regularizes the recovered image based on image prior(s).

(Phong et al., 2017) brings theoretical insights on this task by proving that
such reconstruction is possible with a single-layer neural network. (Zhu et
al., 2019) is the first to show that accurate pixel-level reconstruction is
practical for a maximum batch size of 8. Their formulation uses
$\ell_{2}$-distance as $\mathcal{L}_{\rm grad}(\cdot,\cdot)$ but no
regularization term $\mathcal{R}_{\rm aux}(x)$. The approach works for low-
resolution CIFAR datasets (Krizhevsky et al., 2009), with simple neural
networks with sigmoid activations, but cannot scale up to high-resolution
images, or larger models with ReLU activations. A follow-up (Zhao et al.,
2020) proposes a simple approach to extract the ground-truth labels from the
gradient, which improves the attack but still cannot overcome its limitations.

With a careful choice of $\mathcal{L}_{\rm grad}$ and $\mathcal{R}_{\rm
aux}(x)$, (Geiping et al., 2020) substantially improves the attack and
succeeds in recovering a single ImageNet (Deng et al., 2009) image from
gradient: their approach uses cosine distance as $\mathcal{L}_{\rm grad}$, and
the total variation as $\mathcal{R}_{\rm aux}(x)$. Their approach is able to
reconstruct low-resolution images with a maximum batch size of 100 or a single
high-resolution image. Based on (Geiping et al., 2020), (Wei et al., 2020)
analyzes how different configurations in the training may affect attack
effectiveness.

A more recent work (Yin et al., 2021) further improves the attack on high-
resolution images, by introducing to $\mathcal{R}_{\rm aux}(x)$ a new image
prior term based on batch normalization (Ioffe and Szegedy, 2015) statistics,
and a regularization term which enforces consistency across multiple attack
trials.

An orthogonal line of work (Zhu and Blaschko, 2021) proposes to formulate the
gradient inversion attack as a closed-form recursive procedure, instead of an
optimization problem. However, their implementation can recover only low-
resolution images under the setting where batch size = 1.

##  3 Strong Assumptions Made by SOTA Attacks

###  3.1 The state-of-the-art attacks

Two recent attacks (Geiping et al., 2020; Yin et al., 2021) achieve best
recovery results. Our analysis focuses on the former as the implementation of
the latter is not available at the time of writing this paper. We plan to
include the analysis for the latter attack in the final version of this paper
if its implementation becomes available.

(Geiping et al., 2020)’s attack optimizes the following objective function:

$\arg\min_{x}1-\frac{\left\langle\nabla_{\theta}\mathcal{L}_{\theta}(x,y),\nabla_{\theta}\mathcal{L}_{\theta}\left(x^{*},y^{*}\right)\right\rangle}{\left\|\nabla_{\theta}\mathcal{L}_{\theta}(x,y)\left|\left\|\mid\nabla_{\theta}\mathcal{L}_{\theta}\left(x^{*},y^{*}\right)\right\|\right.\right.}+\alpha_{\rm
TV}\mathcal{R}_{\rm TV}(x)$ (2)

where $\langle\cdot,\cdot\rangle$ is the inner-product between vectors, and
$\mathcal{R}_{\rm TV}(\cdot)$ is the total variation of images.

We notice that Geiping et al. has made two strong assumptions (Section 3.2).
Changing setups to invalidate those assumptions will substantially weaken the
attacks (Section 3.3). We also summarize whether other attacks have made
similar assumptions in Table 1.

###  3.2 Strong assumptions

We find that previous gradient inversion attacks have made different
assumptions about whether the attacker knows Batch normalization statistics or
private labels, as shown in Table 3.2. Note that (Geiping et al., 2020)’s
attack makes both strong assumptions.

#### Assumption 1: Knowing BatchNorm statistics.

Batch normalization (BatchNorm) (Ioffe and Szegedy, 2015) is a technique for
training neural networks that normalizes the inputs to a layer for every mini-
batch. It behaves differently during training and evaluation. Assume the model
has $L$ batch normalization layers. Given $x^{*}$, a batch of input images, we
use $x^{*}_{l}$ to denote the input features to the $l$-th BatchNorm layer,
where $l\in[L]$. During training, the $l$-th BatchNorm layer normalizes
$x^{*}_{l}$ based on the batch’s mean ${\rm mean}(x^{*}_{l})$ and variance
${\rm var}(x^{*}_{l})$, and keeps a running estimate of mean and variance of
all training data points, denoted by $\mu_{l}$ and $\sigma^{2}_{l}$. During
inference, $\\{\mu_{l}\\}_{l=1}^{L}$ and $\\{\sigma^{2}_{l}\\}_{l=1}^{L}$ are
used to normalize test images. In the following descriptions, we leave out
$\\{\cdot\\}_{l=1}^{L}$ for simplicity (i.e. use $\mu,\sigma^{2}$ to denote
$\\{\mu_{l}\\}_{l=1}^{L},\\{\sigma^{2}_{l}\\}_{l=1}^{L}$, and ${\rm
mean}(x^{*})$, ${\rm var}(x^{*})$ to denote $\\{{\rm
mean}(x^{*}_{l})\\}_{l=1}^{L}$, $\\{{\rm var}(x^{*}_{l})\\}_{l=1}^{L}$).

We notice that (Geiping et al., 2020)’s implementation111The official
implementation of (Geiping et al., 2020):
https://github.com/JonasGeiping/invertinggradients. assumes that BatchNorm
statistics of the private batch, i.e., ${\rm mean}(x^{*})$, ${\rm
var}(x^{*})$, are jointly provided with the gradient. Knowing BatchNorm
statistics would enable the attacker to apply the same batch normalization
used by the private batch on his recovered batch, to achieve a better
reconstruction. This implicitly increases the power of the attacker, as
sharing private BatchNorm statistics are not necessary in Federated learning
(Andreux et al., 2020; Li et al., 2021).

Note that this assumption may be realistic in some settings: 1) the neural
network is shallow, thus does not require using BatchNorm layers, or 2) the
neural network is deep, but adapts approaches that normalize batch inputs with
a fixed mean and variance (as alternative to BatchNorm), e.g. Fixup
initialization (Zhang et al., 2019).

#### Assumption 2: Knowing or able to infer private labels.

Private labels are not intended to be shared in Federated learning, but
knowing them would improve the attack. (Zhao et al., 2020) finds that label
information of a single private image can be inferred from the gradient (see
Section 3.3 for details). Based on this, (Geiping et al., 2020) assumes the
attacker knows private labels (see remark at the end of Section 4 in their
paper). However, this assumption may not hold true when multiple images in a
batch share the same label, as we will show in the next section.

Assumptions | (Zhu et al., 2019) | (Zhao et al., 2020) | (Geiping et al., 2020) | (Yin et al., 2021)
---|---|---|---|---
Knowing BN statistics |  N/A† |  N/A† | Yes |  Yes∗
Knowing private labels | No |  No‡ | Yes |  No‡
Table 1: Assumptions of gradient inversion attacks. †: its evaluation uses a
simple model without a BatchNorm layer; ‡: it proposes a method to infer
private labels, which works when images in a batch have unique labels (see
Section 3.3); ∗: although the paper discusses a setting where BatchNorm
statistics are unknown, its main results assume knowing BatchNorm statistics.

###  3.3 Re-evaluation under relaxed assumptions

We re-evaluate the performance of the gradient inversion attack in settings
where two assumptions above are relaxed. For each relaxation, we re-design the
attack (if needed) based on the knowledge that the attacker has.

#### Relaxation 1: Not knowing BatchNorm statistics.

We refer to the previous threat model as $\rm BN_{exact}$, where the attacker
knows exact BatchNorm statistics of the private batch. We consider a more
realistic threat model where these statistics are not exposed, and re-design
the attack based on it.

Threat model. In each training step, the client normalizes its private batch
$x^{*}$ using the batch’s mean ${\rm mean}(x^{*})$ and variance ${\rm
var}(x^{*})$, keeps the running estimate of mean and variance locally as in
(Li et al., 2021), and shares the gradient. The client releases the final
aggregated mean $\mu$, and aggregated variance $\sigma^{2}$ of all training
data points at the end of training. Same as before, the attacker has access to
the model and the gradient during training.

Re-design A: $\rm BN_{proxy}$, attacker naively uses $\mu$ and $\sigma^{2}$. A
simple idea is that the attacker uses $(\mu,\sigma^{2})$ as the proxy for
$({\rm mean}(x^{*}),{\rm var}(x^{*}))$, and uses them to normalize $x$, his
guesses of the private batch. Other operations of the gradient inversion
attack remain the same as before. However, Figure 1.d and 1.h show poor-
quality reconstruction with this re-design.

Re-design B: $\rm BN_{infer}$, attacker infers $({\rm mean}(x^{*}),{\rm
var}(x^{*}))$ based on $(\mu,\sigma^{2})$. A more reasonable attacker will try
to infer $({\rm mean}(x^{*}),{\rm var}(x^{*}))$ while updating $x$, his
guesses of the private batch, and uses $({\rm mean}(x),{\rm var}(x))$ to
normalize the batch. In this case, $(\mu,\sigma^{2})$ could be used as a prior
of BatchNorm statistics to regularize the recovery, as suggested in (Yin et
al., 2021):

$\arg\min_{x}1-\frac{\left\langle\nabla_{\theta}\mathcal{L}_{\theta}(x,y),\nabla_{\theta}\mathcal{L}_{\theta}\left(x^{*},y^{*}\right)\right\rangle}{\left\|\nabla_{\theta}\mathcal{L}_{\theta}(x,y)\left|\left\|\mid\nabla_{\theta}\mathcal{L}_{\theta}\left(x^{*},y^{*}\right)\right\|\right.\right.}+\alpha_{\rm
TV}\mathcal{R}_{\rm TV}(x)+\alpha_{\rm BN}\mathcal{R}_{\rm BN}(x)$ (3)

where $\mathcal{R}_{\mathrm{BN}}(x)=\sum_{l}\|{\rm
mean}(x_{l})-\mu_{l}\|_{2}+\sum_{l}\|{\rm var}(x_{l})-\sigma_{l}^{2}\|_{2}$.

We tune $\alpha_{\rm BN}$ and present the best result in Figure 1.c and 1.g
(see results of different $\alpha_{\rm BN}$’s in Appendix A). As shown, for a
batch of low-resolution images, $\rm BN_{infer}$ gives a much better
reconstruction result than $\rm BN_{proxy}$, but still cannot recover some
details of the private batch when compared with $\rm BN_{exact}$. The result
for a single high-resolution image is worse: the attacker fails to return a
recognizable reconstruction with $\rm BN_{infer}$. This suggests not having
access to BatchNorm statistics of the private batch already weakens the state-
of-the-art gradient inversion attack.

(a) Original

(b) $\rm BN_{exact}$

(c) $\rm BN_{infer}$

(d) $\rm BN_{proxy}$

(e) Original

(f) $\rm BN_{exact}$

(g) $\rm BN_{infer}$

(h) $\rm BN_{proxy}$

Figure 1:  Attacking a batch of 16 low-resolution images from CIFAR-10 (a-d)
and a single high-resolution image from ImageNet (e-h) with different
knowledge of BatchNorm statistics. Attack is weakened when BatchNorm
statistics are not available (c, d versus b, and g, h versus f). See Appendix
A for more examples and quantitative results.

#### Relaxation 2: Not knowing private labels.

(Zhao et al., 2020) notes that label information of a single private image can
be computed analytically from the gradients of the layer immediately before
the output layer. (Yin et al., 2021) further extends this method to support
recovery of labels for a batch of images. However, if multiple images in the
private batch belong to a same label, neither approach can tell how many
images belong to that label, let alone which subset of images belong to that
label. Figure 2a demonstrates that with CIFAR-10, for batches of various sizes
it is possible for many of the training samples to be have the same label, and
the distribution of labels is not uniform - and hence, inferring labels
becomes harder and the attack would be weakened. In Figure 2b we evaluate the
worst-case for an attacker in this setting by comparing recoveries where the
batch labels are simultaneously reconstructed alongside the training samples.

(a) Distribution of labels in a batch

(b) Reconstructions with and without private labels

Figure 2:  Attack is weakened when private labels are not available. (a) shows
that for CIFAR-10, when the batch size is large, many images in the batch
belong to the same class, which essentially weakens label restoration (Zhao et
al., 2020; Yin et al., 2021). (b) visualizes a reconstructed batch of 16
images with and without private labels known. The quality of the
reconstruction drops without knowledge of private labels.

##  4 Defenses Against the Gradient Inversion Attack

Several defense ideas have been proposed to mitigate the risks of gradient
inversion.

###  4.1 Encrypt gradients

Cryptography-based approaches encrypt gradient to prevent gradient inversion.
(Bonawitz et al., 2016) presents a secure aggregation protocol for Federated
learning by computing sum of gradient vectors based on secret sharing (Shamir,
1979). (Phong et al., 2018) proposes using homomorphic encryption to encrypt
the gradients before sending. These approaches require special setup and can
be costly to implement.

Moreover, with secure aggregation protocol, an honest-but-curious server can
still launch the gradient inversion attack on the summed gradient vector.
Similarly, an honest-but-curious client can launch the gradient inversion
attack on the model returned by the server to reconstruct other clients’
private data, even with homomorphic encryption.

As alternatives, two other types of defensive mechanisms have been proposed to
mitigate the risks of attacks on plain-text gradient.

###  4.2 Perturbing gradients

#### Gradient pruning.

When proposing the first practical gradient inversion attack, (Zhu et al.,
2019) also suggests a defense by setting gradients of small magnitudes to zero
(i.e. gradient pruning). Based on their attack, they demonstrate that pruning
more than $70\%$ of the gradients would make the recovered images no longer
visually recognizable. However, the suggested prune ratio is determined based
on weaker attacks, and may not remain safe against the state-of-the-art
attack.

#### Adding noise to gradient.

Motivated by DPSGD (Abadi et al., 2016) which adds noise to gradients to
achieve differential privacy (Dwork, 2009; Dwork and Roth, 2014), (Zhu et al.,
2019; Wei et al., 2020) also suggests defending by adding Gaussian or
Laplacian noise to gradient. They show that a successful defense requires
adding high noise level such that its accuracy drops by more than $30\%$ with
CIFAR-10 tasks. Recent works (Papernot et al., 2020; Tramèr and Boneh, 2021)
suggest using better pre-training techniques and a large batch size (e.g.
$4,096$) to achieve a better accuracy for DPSGD training.

Since most DPSGD implementations for natural image classification tasks (Abadi
et al., 2016; Papernot et al., 2020; Tramèr and Boneh, 2021) use a pre-
training and fine-tuning pipeline, it is hard to fairly compare with other
defense methods that can directly apply when training the model from scratch.
Thus, we leave the comparison with DPSGD to future work.

###  4.3 Weak encryption of inputs (i.e. encoding inputs)

#### MixUp.

MixUp data augmentation (Zhang et al., 2018a) trains neural networks on
composite images created via linear combination of image pairs. It has been
shown to improve the generalization of the neural network and stabilizes the
training. Recent work also suggests that MixUp increases the model’s
robustness to adversarial examples (Pang et al., 2020; Lamb et al., 2019).

#### InstaHide.

Inspired by MixUp, (Huang et al., 2020) proposes InstaHide as a light-weight
instance-encoding scheme for private distributed learning. To encode an image
$x\in{\mathbb{R}}^{d}$ from a private dataset, InstaHide first picks $k-1$
other images $s_{2},s_{3},\ldots,s_{k}$ from that private dataset, or a large
public dataset, and $k$ random nonnegative coefficients
$\\{\lambda_{i}\\}_{i=1}^{k}$ that sum to $1$, and creates a composite image
$\lambda_{1}x+\sum_{i=2}^{k}\lambda_{i}s_{i}$ ($k$ is typically small, e.g.,
$4$). A composite label is also created using the same set of
coefficients.222Only the labels of examples from the private dataset will get
combined. See (Huang et al., 2020) for details. Then it adds another layer of
security: pick a random sign-flipping pattern $\sigma\in\\{-1,1\\}^{d}$ and
output the encryption
$\tilde{x}=\sigma\circ(\lambda_{1}x+\sum_{i=2}^{k}\lambda_{i}s_{i})$, where
$\circ$ is coordinate-wise multiplication of vectors. The neural network is
then trained on encoded images, which look like random pixel vectors to the
human eye and yet lead to good classification accuracy ($<6\%$ accuracy loss
on CIFAR-10, CIFAR-100, and ImageNet).

Recently, (Carlini et al., 2020) gives an attack to recover private images of
a small dataset, when the InstaHide encodings are revealed to the attacker
(not in a Federated learning setting). Their first step is to train a neural
network on a public dataset for similarity annotation, to infer whether a pair
of InstaHide encodings contain the same private image. With the inferred
similarities of all pairs of encodings, the attacker then runs a combinatorial
algorithm (cubic time in size of private dataset) to cluster all encodings
based on their original private images, and finally uses a regression
algorithm (with the help of composite labels) to recover the private images.

Neither (Huang et al., 2020) or (Carlini et al., 2020) has evaluated their
defense or attack in the Federated learning setting, where the attacker
observes gradients of the encoded images instead of original encoded images.
This necessitates the systematic evaluation in our next section.

##  5 Evaluation of defenses

The main goal of our experiments is to understand the trade-offs between data
utility (accuracy) and securely defending the state-of-the-art gradient
inversion attack even in its strongest setting, without any relaxation of its
implicit assumptions. Specifically, we grant the attacker the knowledge of 1)
BatchNorm statistics of the private batch, and 2) labels of the private batch.

We vary key parameters for each defense, and evaluate their performance in
terms of the test accuracy, computation overhead, and privacy risks (Section
5.2). We then investigate the feasibility of combining defenses (Section 5.3).
We also estimate the computation cost of end-to-end recovery of a single image
under evaluated defenses (Section 5.4).

As the feasibility of the state-of-the-art attack (Geiping et al., 2020) on a
batch of high-resolution images remain elusive when its implicit assumptions
no longer hold (see Figure 1), we focus on the evaluation with low-resolution
in trying to understand whether current attacks can be mitigated.

###  5.1 Experimental setup

#### Key parameters of defenses.

We evaluate following defenses on CIFAR-10 dataset (Krizhevsky et al., 2009)
with ResNet-18 architecture (He et al., 2016).

  * •

GradPrune (gradient pruning): gradient pruning set gradients of small
magnitudes to zero. We vary the pruning ratio $p$ in
$\\{0.5,0.7,0.9,0.95,0.99,0.999\\}$.

  * •

MixUp: MixUp encodes a private image by linearly combining it with $k-1$ other
images from the training set. Following (Huang et al., 2020), we vary $k$ in
$\\{4,6\\}$, and set the upper bound of a single coefficient to $0.65$
(coefficients sum to $1$).

  * •

Intra-InstaHide: InstaHide (Huang et al., 2020) proposes two versions: Inter-
InstaHide and Intra-InstaHide. The only difference is that at the mixup step,
Inter-Instahide mixes up an image with images from a public dataset, whereas
Intra-InstaHide only mixes with private images. Both versions apply a random
sign flipping pattern on each mixed image. We evaluate Intra-InstaHide in our
experiments, which is a weaker version of InstaHide. Similar to the evaluation
of MixUp, we vary $k$ in $\\{4,6\\}$, and set the upper bound of a single
coefficient to $0.65$. Note that InstaHide flips signs of pixels in the image,
which destroys the total variation prior. However, the absolute value of
adjacent pixels should still be close. Therefore, for the InstaHide defense,
we apply the total variation regularizer on $|x|$, i.e. taking absolute value
of each pixel in the reconstruction.

We train the ResNet-18 architecture on CIFAR-10 using different defenses, and
launch the attack. We provide more details of the experiments in Appendix A.

#### The attack.

We use a subset of 50 CIFAR-10 images to evaluate the attack performance. Note
that attacking MixUp and InstaHide involves another step to decode private
images from the encoded images. We apply (Carlini et al., 2020)’s attack here
as the decode step, where the attacker needs to eavesdrop $T$ epochs of
training, instead of a single training step. We set $T=20$ in our evaluation.
We also grant the attacker the strongest power for the decode step to evaluate
the upper bound of privacy leakage. Given a MixUp or Intra-InstaHide image
which encodes $k$ private images, we assume the attacker knows:

  1. 1.

The indices of $k$ images in the private dataset. In a realistic scenario, the
attacker of (Carlini et al., 2020) would need to train a neural network to
detect similarity of encodings, and run a combinatorial algorithm to solve an
approximation of this mapping.

  2. 2.

The mixing coefficients for each of the $k$ private image. In real Federated
learning, this information is not available.

#### Hyper-parameters of the attack.

The attack minimize the objective function given in Eq.3. We search
$\alpha_{\rm TV}$ in $\\{0,0.001,0.005,0.01,0.05,0.1,0.5\\}$ for all defenses,
and apply the best choice for each defense: $0.05$ for GradPrune, $0.1$ for
MixUp, and $0.01$ for Intra-InstaHide. We apply $\alpha_{\rm BN}=0.001$ for
all defenses after searching it in $\\{0,0.0005,0.001,0.01,0.05,0.01\\}$. We
optimize the attack for $10,000$ iterations using Adam (Kingma and Ba, 2015),
with initial learning rate $0.1$. We decay the learning rate by a factor of
$0.1$ at $3/8,5/8,7/8$ of the optimization.

#### Batch size of the attack.

(Zhu et al., 2019; Geiping et al., 2020) have shown that a small batch size is
important for the success of the attack. We intentionally evaluate the attack
with three small batch sizes to test the upper bound of privacy leakage,
including the minimum (and unrealistic) batch size 1, and two small but
realistic batch sizes, 16 and 32.

#### Metrics for reconstruction quality.

We visualize reconstructions obtained under different defenses. Following (Yin
et al., 2021), we also use the learned perceptual image patch similarity
(LPIPS) score (Zhang et al., 2018b) to measure mismatch between reconstruction
and original images: higher values suggest more mismatch (less privacy
leakage).

Figure 3: Reconstruction results under different defenses with batch size
being 1, 16 and 32. When batch size is 32, combining gradient pruning and
Intra-InstaHide makes the reconstruction almost unrecognizable (the last
column). See Figure 7 in Appendix A for the full version.

| None | GradPrune ($p$) | MixUp ($k$) | Intra-InstaHide ($k$) | GradPrune ($p=0.9$)
---|---|---|---|---|---
| \+ MixUp | \+ Intra-InstaHide
Parameter | - | 0.5 | 0.7 | 0.9 | 0.95 | 0.99 | 0.999 | 4 | 6 | 4 | 6 | $k=4$ | $k=4$
Test Acc. | 93.37 | 93.19 | 93.01 | 90.57 | 89.92 | 88.61 | 83.58 | 92.31 | 90.41 | 90.04 | 88.20 | 91.37 | 86.10
Time (train) | $1\times$ | $1.04\times$ | $1.06\times$ | $1.06\times$ | $1.10\times$
Attack batch size $=1$
Avg. LPIPS $\downarrow$ | 0.19 | 0.19 | 0.22 | 0.35 | 0.42 | 0.52 | 0.52 | 0.34 | 0.46 | 0.58 | 0.61 | 0.41 | 0.60
Best LPIPS $\downarrow$ | 0.02 | 0.02 | 0.05 | 0.14 | 0.22 | 0.32 | 0.36 | 0.12 | 0.25 | 0.41 | 0.42 | 0.21 | 0.43
(LPIPS std.) | 0.16 | 0.17 | 0.16 | 0.13 | 0.11 | 0.08 | 0.06 | 0.08 | 0.07 | 0.06 | 0.09 | 0.07 | 0.09
Attack batch size $=16$
Avg. LPIPS $\downarrow$ | 0.45 | 0.46 | 0.47 | 0.51 | 0.55 | 0.58 | 0.61 | 0.34 | 0.31 | 0.62 | 0.63 | 0.46 | 0.68
Best LPIPS $\downarrow$ | 0.18 | 0.19 | 0.19 | 0.31 | 0.43 | 0.47 | 0.51 | 0.11 | 0.13 | 0.41 | 0.44 | 0.22 | 0.54
(LPIPS std.) | 0.12 | 0.12 | 0.11 | 0.07 | 0.05 | 0.04 | 0.03 | 0.09 | 0.09 | 0.08 | 0.08 | 0.10 | 0.07
Attack batch size $=32$
Avg. LPIPS $\downarrow$ | 0.45 | 0.46 | 0.48 | 0.52 | 0.54 | 0.58 | 0.63 | 0.50 | 0.49 | 0.69 | 0.69 | 0.62 | 0.73
Best LPIPS $\downarrow$ | 0.18 | 0.18 | 0.22 | 0.31 | 0.43 | 0.48 | 0.54 | 0.31 | 0.28 | 0.56 | 0.56 | 0.37 | 0.65
(LPIPS std.) | 0.11 | 0.11 | 0.09 | 0.07 | 0.05 | 0.04 | 0.04 | 0.10 | 0.10 | 0.06 | 0.07 | 0.10 | 0.05

(a)  (b)

Table 2: Utility-security trade-off of different defenses. We train the
ResNet-18 model on the whole CIFAR-10 dataset, and report the averaged test
accuracy and running time of 5 independent runs. We evaluate the attack on a
subset of 50 CIFAR-10 images, and report the LPIPS score ($\downarrow$: lower
values suggest more privacy leakage). We mark the least-leakage defense
measured by the metric in green.

###  5.2 Performance of defense methods

We summarize the performance of each defense in Table 2, and visualize
reconstructed images in Figure 3. We report the averaged and the best results
for the metric of reconstruction quality, as a proxy for average-case and
worst-case privacy leakage.

#### No defense.

Without any defense, when batch size is 1, the attack can recover images well
from the gradient. Increasing the batch size makes it difficult to recover
well, but the recovered images are visually similar to the originals (see
Figure 3).

#### Gradient pruning (GradPrune).

Figure 3 shows that as the pruning ratio $p$ increases, there are more
artifacts in the reconstructions. However, the reconstructions are still
recognizable even when the pruning ratio $p=0.9$, thus the previous suggestion
of using $p=0.7$ by (Zhu et al., 2019) is no longer safe against the state-of-
the-art attack. Our results suggest that, for CIFAR-10, defending the
strongest attack with gradient pruning may require the pruning ratio $p\geq
0.999$. As a trade-off, such a high pruning ratio would introduce an accuracy
loss of around $10\%$ (see Table 2).

#### MixUp.

MixUp introduces a small computational overhead to training. MixUp with $k=4$
only has a minor impact (~$2\%$) on test accuracy, but it is not sufficient to
defend the gradient inversion attack (see Figure 3). Increasing $k$ from $4$
to $6$ slightly reduces the leakage, however, the reconstruction is still
highly recognizable. This suggests that MixUp alone may not be a practical
defense against the state-of-the-art gradient inversion attack.

#### Intra-InstaHide.

Intra-InstaHide with $k=4$ incurs an extra ~$2\%$ accuracy loss compared with
MixUp, but it achieves better defense performance: when batch size is 32,
there are obvious artifacts and color shift in the reconstruction (see Figure
3). However, with batch size 32, Intra-InstaHide alone also cannot defend the
state-of-the-art gradient inversion, as structures of private images are still
vaguely identifiable in reconstructions.

Appendix A provides the whole reconstructed dataset under MixUp and Intra-
InstaHide.

###  5.3 Performance of combined defenses

We notice that two types of defenses (i.e perturbing gradient and encoding
inputs) are complementary to each other, which motivates an evaluation of
combining gradient pruning with MixUp or Intra-InstaHide.

As shown in Figure 3, when the batch size is 32, combining Intra-InstaHide
($k=4$) with gradient pruning ($p=0.9$) makes the reconstruction almost
unrecognizable. The combined defense yields a higher LPIPS score than using
gradient pruning with $p=0.999$, but introduces a smaller accuracy loss
(~$7\%$ compared with a no-defense pipeline).

Note that our evaluation uses the strongest attack and relatively small batch
sizes. As shown in Appendix A, invalidating assumptions in Section 3 or
increasing the batch size may hinder the attack with an even weaker defense
(e.g. with a lower $p$, or smaller $k$), which gives a better accuracy.

###  5.4 Time estimate for end-to-end recovery of a single image

Table 3 shows time estimates for the end-to-end recovery of a single image in
a Federated learning setting with GradPrune or InstaHide defense. We do not
estimate for MixUp since it has been shown to be a weak defense (see Section
5.2).

Our time estimates consider three fairly small dataset sizes. The largest size
in our estimate is a small fraction of a dataset of ImageNet scale. We
consider a client holds a dataset of $N$ private images and participates in
Federated learning, which trains a ResNet-18 model with batch size $b=128$.
Assumes that the resolution of the client’s data is $32\times 32\times 3$. If
the attacker uses a single NVIDIA GeForce RTX 2080 Ti GPU as his computation
resource, and runs gradient inversion with 10,000 iterations of optimization,
then $t$, the running time for attacking a single batch is ~$0.25$ GPU hours
(batch size $b$ has little impact on the attack’s running time, but a larger
$b$ makes the attack less effective).

#### Non-defended and gradient pruning.

Recovering a single image in a non-defended pipeline (or a pipeline that
applies gradient pruning alone as the defense) only requires the attacker to
invert gradient of a single step of training, which takes time $t$.

#### InstaHide.

When InstaHide is applied, the current attack (Carlini et al., 2020) suggests
that recovering a single image would involve recovering the whole dataset
first. As discussed in Section 4, Carlini et al.’s attack consists of two
steps: 1) recover InstaHide images from gradient of $T$ epochs. This would
take $(NT/b)\times t$ GPU hours. 2) Run the decode attack (Carlini et al.,
2020) on InstaHide images to recover the private dataset, which involves:

  1. 2a

Train a neural network to detect similarity in recovered InstaHide images.
Assume that training the network requires at least $n$ recovered InstaHide
images, then collecting these images by running gradient inversion would take
$(n/b)\times t$ GPU hours. The training takes $10$ GPU hours according to
(Carlini et al., 2020), so training the similarity network would take
$(n/b)\times t+10$ GPU hours in total.

  2. 2b

Run the combinotorial algorithm to recover original images. Running time of
this step has been shown to be at least quadratic in $m$, the number of
InstaHide encodings (Chen et al., 2021). This step takes $1/6$ GPU hours with
$m=5\times 10^{3}$. Therefore for $m=NT$, the running time is at least
$1/6\times(\frac{NT}{5\times 10^{3}})^{2}$ GPU hours.

In total, an attack on InstaHide in this real-world setting would take
$(NT/b)\times t+(n/b)\times t+10+1/6\times(\frac{NT}{5\times 10^{3}})^{2}$ GPU
hours. We use $T=50$ (used by (Carlini et al., 2020)), $n=10,000$ and give
estimate in Table 3. As shown, when InstaHide is applied on a small dataset
($N=5,000$), the end-to-end recovery of a single image takes $>3,000\times$
longer than in a no-defense pipeline or GradPrune pipeline; when InstaHide is
applied on a larger dataset ($N=500,000$), the computation cost for end-to-end
recovery is enormous.

Size of client’s dataset ($N$) | No defense | GradPrune | InstaHide
---|---|---|---
5,000 | 0.25 | 0.25 | 934.48
50,000 |  46,579.01 ($\approx$ 5.5 GPU years)
500,000 |  4,215,524.32 ($\approx$ 493.4 GPU years)
Table 3: Time estimates (NVIDIA GeForce RTX 2080 Ti GPU hours) of recovering a
single image from the client’s dataset using the state-of-the-art gradient
inversion attack (Geiping et al., 2020) under different defenses. We assume
image resolution of the client’s data is $32\times 32\times 3$.

##  6 Conclusions

This paper first points out that some state-of-the-art gradient inversion
attacks have made strong assumptions about knowing BatchNorm statistics and
private labels. Relaxing such assumptions can significantly weaken these
attacks.

The paper then reports the performance of a set of proposed defenses against
gradient inversion attacks, and estimates the computation cost of an end-to-
end recovery of a single image in different dataset sizes. Our evaluation
shows that InstaHide without mixing with data from a public dataset combined
with gradient pruning can defend the state-of-the-art attack, and the
estimated time to recover a single image in a medium-size client dataset (e.g.
of 500,000 images) is enormous.

Based on our evaluation of the attack by (Geiping et al., 2020) and multiple
defenses for plain-text gradients, we have the following observations:

  * •

Using BatchNorm layers in your deep net but don’t share BatchNorm statistics
of the private batch during Federated learning weakens the attack. We have
demonstrated in Section 3 that exposing BatchNorm statistics to the attacker
significantly improves the quality of gradient inversion. So a more secure
configuration of Federated Learning would be to use BatchNorm layers, but do
not share BatchNorm statistics in training, which has been shown feasible in
(Andreux et al., 2020; Li et al., 2021).

  * •

Using a large batch size weakens the attack; a batch size smaller than 32 is
not safe. We have shown that a larger batch size hinders the attack by making
it harder to guess the private labels (Section 3) and to recover the private
images even with correct private labels (Section 5). Our experiments suggest
that even with some weak defenses applied, a batch size smaller than 32 is not
safe against the strongest gradient inversion attack.

  * •

Combining multiple defenses may achieve a better utility-privacy trade-off. In
our experiment, for a batch size of 32, combining InstaHide ($k=4$) with
gradient pruning ($p=0.9$) achieves the best utility-privacy trade-off, by
making the reconstruction almost unrecognizable at a cost of ~$7\%$ accuracy
loss (using InstaHide also makes the end-to-end recovery of a single image
more computationally expensive). Best parameters would vary for different deep
learning tasks, but we strongly encourage Federated learning participants to
explore the possibility of combining multiple defensive mechanisms, instead of
only using one of them.

We hope to extend our work by including evaluation of defenses for high-
resolution images, the attack by (Yin et al., 2021) (when its implementation
becomes available), and more defense mechanisms including those rely on adding
noise to gradients.

## Acknowledgments

This project is supported in part by Ma Huateng Foundation, Schmidt
Foundation, NSF, Simons Foundation, ONR and DARPA/SRC. Yangsibo Huang and
Samyak Gupta are supported in part by the Princeton Graduate Fellowship.

We would like to thank Quanzheng Li, Xiaoxiao Li, Hongxu Yin and Aoxiao Zhong
for helpful discussions, and members of Kai Li’s and Sanjeev Arora’s research
groups for comments on early versions of the work.

## References

  * Abadi et al. [2016] Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang.  Deep learning with differential privacy.  In _Proceedings of the 2016 ACM SIGSAC conference on computer and communications security_ , pages 308–318, 2016.
  * Act [1996] Accountability Act.  Health insurance portability and accountability act of 1996.  _Public law_ , 104:191, 1996.
  * Andreux et al. [2020] Mathieu Andreux, Jean Ogier du Terrail, Constance Beguier, and Eric W Tramel.  Siloed federated learning for multi-centric histopathology datasets.  In _Domain Adaptation and Representation Transfer, and Distributed and Collaborative Learning_ , pages 129–139. Springer, 2020.
  * Bonawitz et al. [2016] K. A. Bonawitz, Vladimir Ivanov, Ben Kreuter, Antonio Marcedone, H. Brendan McMahan, Sarvar Patel, Daniel Ramage, Aaron Segal, and Karn Seth.  Practical secure aggregation for federated learning on user-held data.  In _NIPS Workshop on Private Multi-Party Machine Learning_ , 2016\.
  * Carlini et al. [2020] Nicholas Carlini, Samuel Deng, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, Shuang Song, Abhradeep Thakurta, and Florian Tramer.  An attack on instahide: Is private learning possible with instance encoding?  In _IEEE Symposium on Security and Privacy_ , 2020.
  * Chen et al. [2021] Sitan Chen, Xiaoxiao Li, Zhao Song, and Danyang Zhuo.  On instahide, phase retrieval, and sparse matrix factorization.  In _ICLR_ , 2021.
  * Cohen et al. [2019] Michael B Cohen, Yin Tat Lee, and Zhao Song.  Solving linear programs in the current matrix multiplication time.  In _Proceedings of the 51st Annual ACM Symposium on Theory of Computing (STOC)_ , 2019.
  * Commission [2018] European Commission.  2018 reform of eu data protection rules.  https://gdpr-info.eu/, 2018.
  * Deng et al. [2009] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  Imagenet: A large-scale hierarchical image database.  In _CVPR_ , 2009.
  * Deng [2012] Li Deng.  The mnist database of handwritten digit images for machine learning research.  _IEEE Signal Processing Magazine_ , 29(6):141–142, 2012.
  * Dwork [2009] Cynthia Dwork.  The differential privacy frontier.  In _Theory of Cryptography Conference (TCC)_ , pages 496–502, 2009\.
  * Dwork and Roth [2014] Cynthia Dwork and Aaron Roth.  The algorithmic foundations of differential privacy.  _Foundations and Trends in Theoretical Computer Science_ , 9(3–4):211–407, 2014.
  * Geiping et al. [2020] Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller.  Inverting gradients–how easy is it to break privacy in federated learning?  In _NeurIPS_ , 2020.
  * He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _CVPR_ , 2016.
  * Huang et al. [2020] Yangsibo Huang, Zhao Song, Kai Li, and Sanjeev Arora.  Instahide: Instance-hiding schemes for private distributed learning.  In _ICML_ , 2020.
  * Ioffe and Szegedy [2015] Sergey Ioffe and Christian Szegedy.  Batch normalization: Accelerating deep network training by reducing internal covariate shift.  In _ICML_ , 2015.
  * Kairouz et al. [2021] Peter Kairouz, H Brendan McMahan, Brendan Avent, Aurélien Bellet, Mehdi Bennis, Arjun Nitin Bhagoji, Keith Bonawitz, Zachary Charles, Graham Cormode, Rachel Cummings, et al.  Advances and open problems in federated learning.  _Foundations and Trends in Machine Learning_ , 14(1–2):1–210, 2021.
  * Kingma and Ba [2015] Diederik P Kingma and Jimmy Ba.  Adam: A method for stochastic optimization.  In _ICLR_ , 2015.
  * Krizhevsky et al. [2009] Alex Krizhevsky et al.  Learning multiple layers of features from tiny images.  2009\.
  * Lamb et al. [2019] Alex Lamb, Vikas Verma, Juho Kannala, and Yoshua Bengio.  Interpolated adversarial training: Achieving robust neural networks without sacrificing too much accuracy.  In _Proceedings of the 12th ACM Workshop on Artificial Intelligence and Security_ , pages 95–103, 2019.
  * Legislature [2018] California State Legislature.  California consumer privacy act.  https://oag.ca.gov/privacy/ccpa, 2018.
  * Li et al. [2021] Xiaoxiao Li, Meirui Jiang, Xiaofei Zhang, Michael Kamp, and Qi Dou.  Fedbn: Federated learning on non-iid features via local batch normalization.  In _ICLR_ , 2021.
  * McMahan et al. [2016] H Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, et al.  Communication-efficient learning of deep networks from decentralized data.  In _Artificial Intelligence and Statistics (AISTATS)_ , pages 1273–1282, 2016.
  * Pang et al. [2020] Tianyu Pang, Kun Xu, and Jun Zhu.  Mixup inference: Better exploiting mixup to defend adversarial attacks.  In _ICLR_ , 2020.
  * Papernot et al. [2020] Nicolas Papernot, Steve Chien, Shuang Song, Abhradeep Thakurta, and Ulfar Erlingsson.  Making the shoe fit: Architectures, initializations, and tuning for learning with privacy, 2020.  URL https://openreview.net/forum?id=rJg851rYwH.
  * Phong et al. [2017] Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai.  Privacy-preserving deep learning: Revisited and enhanced.  In _ICATIS_ , pages 100–110, 2017.
  * Phong et al. [2018] Le Trieu Phong, Yoshinori Aono, Takuya Hayashi, Lihua Wang, and Shiho Moriai.  Privacy-preserving deep learning via additively homomorphic encryption.  _IEEE Transactions on Information Forensics and Security_ , 2018.
  * Shamir [1979] Adi Shamir.  How to share a secret.  _Communications of the ACM_ , 22(11):612–613, 1979.
  * Tramèr and Boneh [2021] Florian Tramèr and Dan Boneh.  Differentially private learning needs better features (or much more data).  In _ICLR_ , 2021.
  * Wei et al. [2020] Wenqi Wei, Ling Liu, Margaret Loper, Ka-Ho Chow, Mehmet Emre Gursoy, Stacey Truex, and Yanzhao Wu.  A framework for evaluating gradient leakage attacks in federated learning.  _arXiv preprint arXiv:2004.10397_ , 2020.
  * Yin et al. [2021] Hongxu Yin, Arun Mallya, Arash Vahdat, Jose M Alvarez, Jan Kautz, and Pavlo Molchanov.  See through gradients: Image batch recovery via gradinversion.  _arXiv preprint arXiv:2104.07586_ , 2021.
  * Zhang et al. [2018a] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz.  Mixup: Beyond empirical risk minimization.  In _ICLR_ , 2018a.
  * Zhang et al. [2019] Hongyi Zhang, Yann N Dauphin, and Tengyu Ma.  Fixup initialization: Residual learning without normalization.  In _ICLR_ , 2019.
  * Zhang et al. [2018b] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang.  The unreasonable effectiveness of deep features as a perceptual metric.  In _CVPR_ , 2018b.
  * Zhao et al. [2020] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen.  idlg: Improved deep leakage from gradients.  _arXiv preprint arXiv:2001.02610_ , 2020.
  * Zhu and Blaschko [2021] Junyi Zhu and Matthew Blaschko.  R-gap: Recursive gradient attack on privacy.  In _ICLR_ , 2021.
  * Zhu et al. [2019] Ligeng Zhu, Zhijian Liu, and Song Han.  Deep leakage from gradients.  In _NeurIPS_ , 2019.

##  Appendix A Experimental details and more results

We run all the experiments on Nvidia RTX 2080 Ti GPUs and V100 GPUs. Table 4
summarizes the set of images used in each figure or table in the main paper.

Figure/Table |  Comments
---|---
Figure 1a |  We’ve tuned hyperparams for the attack (see Appendix A.1) and carried out evaluations on the whole CIFAR-subset. The first sampled batch of size 16 from CIFAR-subset was used in Figure 1a to demonstrate the quality of recovery for low-resolution images when BatchNorm statistics are not assumed to be known.
Figure 1b |  We’ve tuned hyperparams for the attack (see Appendix A.1) and carried out evaluations on the whole ImageNet-subset. The best-reconstructed image in ImageNet-subset was used in Figure 1b to demonstrate the quality of recovery for high-resolution images when BatchNorm statistics are not assumed to be known.
Figure 2a |  Percentages of class labels per batch were evaluated over the entire CIFAR10 dataset, for a random seed.
Figure 2b |  The first sampled batch of size 16 was used in Figure 2b to demonstrate the quality of recovery when labels are not assumed to be known.
Table 2 and Figure 3 |  We’ve tuned hyperparams for the attack and carried out evaluations on the whole CIFAR-subset. Table 2 summarizes the performance of the attack on the whole CIFAR-subset and Figure 3 shows example images.
Table 4: Summary of experimental testbed for each evaluation.

###  A.1 Hyper-parameters

#### Training.

For all experiments, we train ResNet-18 for 200 epochs, with a batch size of
128. We use SGD with momentum 0.9 as the optimizer. The initial learning rate
is set to 0.1 by default, except for gradient pruning with $p=0.99$ and
$p=0.999$. where we set the initial learning rate to 0.02. We decay the
learning rate by a factor of 0.1 every 50 epochs.

#### The attack.

We report the performance under different $\alpha_{\rm TV}$’s (Figure 4) and
$\alpha_{\rm BN}$’s (Figure 5).

(a) Original

(b) $\alpha_{\rm TV}$=0

(c) $\alpha_{\rm TV}$=1e-3

(d) $\alpha_{\rm TV}$=5e-3

(e) $\alpha_{\rm TV}$=1e-2

(f) $\alpha_{\rm TV}$=5e-2

(g) $\alpha_{\rm TV}$=1e-1

(h) $\alpha_{\rm TV}$=5e-1

Figure 4: Attacking a single CIFAR-10 images in $\rm BN_{exact}$ setting, with
different coefficients for the total variation regularizer ($\alpha_{\rm
TV}$’s). $\alpha_{\rm TV}$=1e-2 gives the best reconstruction.

(a) Original

(b) $\alpha_{\rm BN}$=0

(c) $\alpha_{\rm BN}$=5e-4

(d) $\alpha_{\rm BN}$=1e-3

(e) $\alpha_{\rm BN}$=5e-3

(f) $\alpha_{\rm BN}$=1e-2

Figure 5: Attacking a batch of 16 CIFAR-10 images in $\rm BN_{infer}$ setting,
with different coefficients for the BatchNorm regularizer ($\alpha_{\rm
BN}$’s). $\alpha_{\rm TV}$=1e-3 gives the best reconstruction.

###  A.2 Details and more results for Section 3

#### Attacking a single ImageNet image.

We launched the attack on ImageNet using the objective function in Eq. 3,
where $\alpha_{\rm TV}=0.1$, $\alpha_{\rm BN}=0.001$. We run the attack for
24,000 iterations using Adam optimizer, with initial learning rate 0.1, and
decay the learning rate by a factor of $0.1$ at $3/8,5/8,7/8$ of training. We
rerun the attack 5 times and present the best results measured by LPIPS in
Figure 1.

#### Qualitative and quantitative results for a more realistic attack.

We also present results of a more realistic attack in Table 5 and Figure 6,
where the attacker does not know BatchNorm statistics but knows the private
labels. We assume the private labels to be known in this evaluation, because
for those batches whose distribution of labels is uniform, the restoration of
labels should still be quite accurate [Yin et al., 2021]. As shown, in the
evaluated setting, the attack is no longer effective when the batch size is 32
and Intra-InstaHide with $k=4$ is applied. The accuracy loss to stop the
realistic attack is only around $3\%$ (compared to around $7\%$ to stop the
strongest attack) .

(a)  Figure 6: Reconstruction results under different defenses for a more realistic setting (when the attacker knows private labels but does not know BatchNorm statistics). We also present the results for the strongest attack from Figure 3 for comparison. Using Intra-InstaHide with $k=4$ and batch size 32 seems to stop the realistic attack. | None | GradPrune ($p$) | MixUp ($k$) | Intra-InstaHide ($k$) | GradPrune ($p=0.9$)
---|---|---|---|---|---
| \+ MixUp | \+ Intra-InstaHide
Parameter | - | 0.5 | 0.7 | 0.9 | 0.95 | 0.99 | 0.999 | 4 | 6 | 4 | 6 | $k=4$ | $k=4$
Test Acc. | 93.37 | 93.19 | 93.01 | 90.57 | 89.92 | 88.61 | 83.58 | 92.31 | 90.41 | 90.04 | 88.20 | 91.37 | 86.10
Time (train) | $1\times$ | $1.04\times$ | $1.06\times$ | $1.06\times$ | $1.10\times$
Attack batch size $=16$, the strongest attack
Avg. LPIPS $\downarrow$ | 0.41 | 0.41 | 0.42 | 0.46 | 0.48 | 0.50 | 0.55 | 0.50 | 0.49 | 0.69 | 0.69 | 0.62 | 0.73
Best LPIPS $\downarrow$ | 0.21 | 0.22 | 0.27 | 0.29 | 0.30 | 0.29 | 0.48 | 0.31 | 0.28 | 0.56 | 0.56 | 0.37 | 0.65
(LPIPS std.) | 0.09 | 0.08 | 0.07 | 0.06 | 0.06 | 0.06 | 0.04 | 0.10 | 0.10 | 0.06 | 0.07 | 0.10 | 0.05
Attack batch size $=16$, attacker knows private labels but does not know
BatchNorm statistics
Avg. LPIPS $\downarrow$ | 0.49 | 0.51 | 0.48 | 0.51 | 0.52 | 0.56 | 0.60 | 0.71 | 0.71 | 0.75 | 0.75 | 0.74 | 0.74
Best LPIPS $\downarrow$ | 0.30 | 0.33 | 0.31 | 0.33 | 0.34 | 0.39 | 0.44 | 0.48 | 0.53 | 0.65 | 0.63 | 0.61 | 0.63
(LPIPS std.) | 0.08 | 0.09 | 0.08 | 0.08 | 0.07 | 0.07 | 0.05 | 0.08 | 0.07 | 0.04 | 0.05 | 0.08 | 0.05
Attack batch size $=32$, the strongest attack
Avg. LPIPS $\downarrow$ | 0.45 | 0.46 | 0.48 | 0.52 | 0.54 | 0.58 | 0.63 | 0.50 | 0.49 | 0.69 | 0.69 | 0.62 | 0.73
Best LPIPS $\downarrow$ | 0.18 | 0.18 | 0.22 | 0.31 | 0.43 | 0.48 | 0.54 | 0.31 | 0.28 | 0.56 | 0.56 | 0.37 | 0.65
(LPIPS std.) | 0.11 | 0.11 | 0.09 | 0.07 | 0.05 | 0.04 | 0.04 | 0.10 | 0.10 | 0.06 | 0.07 | 0.10 | 0.05
Attack batch size $=32$, attacker knows private labels but does not know
BatchNorm statistics
Avg. LPIPS $\downarrow$ | 0.48 | 0.50 | 0.53 | 0.53 | 0.55 | 0.60 | 0.63 | 0.73 | 0.72 | 0.76 | 0.76 | 0.76 | 0.77
Best LPIPS $\downarrow$ | 0.29 | 0.32 | 0.32 | 0.31 | 0.40 | 0.41 | 0.55 | 0.63 | 0.60 | 0.68 | 0.63 | 0.66 | 0.65
(LPIPS std.) | 0.08 | 0.07 | 0.07 | 0.08 | 0.08 | 0.06 | 0.04 | 0.06 | 0.06 | 0.04 | 0.05 | 0.06 | 0.05
Table 5: Utility-security trade-off of different defenses for a more realistic
setting (when the attacker knows private labels but does not know BatchNorm
statistics). We also present the results for the strongest attack from Table 2
for comparison. We evaluate the attack on 50 CIFAR-10 images and report the
LPIPS score ($\downarrow$: lower values suggest more privacy leakage). We mark
the least-leakage defense measured by the metric in green.

###  A.3 More results for the strongest attack

#### Full version of Figure 3.

Figure 7 provides more examples for reconstructed images by the strongest
attack under different defenses and batch sizes.

(a) Batch size $=1$

(b) Batch size $=16$

(c) Batch size $=32$

Figure 7: Reconstruction results under different defenses with batch size 1
(a), 16 (b) and 32 (c). Full version of Figure 3.

#### Results with MNIST dataset.

We’ve repeated our main evaluation of defenses and attacks (Table 2) on MNIST
dataset [Deng, 2012] with a simple 6-layer ConvNet model. Note that the simple
ConvNet does not contain BatchNorm layers. We evaluate the following defenses
on the MNIST dataset with a 6-layer ConvNet architecture against the strongest
attack (private labels known):

  * •

GradPrune (gradient pruning): gradient pruning sets gradients of small
magnitudes to zero. We vary the pruning ratio $p$ in {0.5, 0.7, 0.9, 0.95,
0.99, 0.999, 0.9999}.

  * •

MixUp: we vary $k$ in {4,6}, and set the upper bound of a single coefficient
to 0.65 (coefficients sum to 1).

  * •

Intra-InstaHide: we vary $k$ in {4,6}, and set the upper bound of a single
coefficient to 0.65 (coefficients sum to 1).

  * •

A combination of GradPrune and MixUp/Intra-InstaHide.

We run the evaluation against the strongest attack and batch size 1 to
estimate the upper bound of privacy leakage. Specifically, we assume the
attacker knows private labels, as well as the indices of mixed images and
mixing coefficients for MixUp and Intra-InstaHide.

Figure 8: Reconstruction results of MNIST digits under different defenses with
the strongest atttack and batch size 1.

For MNIST with a simple 6-layer ConvNet, defending the strongest attack with
gradient pruning may require the pruning ratio $p\geq 0.9999$. MixUp with
$k=4$ or $k=6$ are not sufficient to defend the gradient inversion attack.
Combining MixUp ($k=4$) with gradient pruning ($p=0.99$) improves the defense,
however, the reconstructed digits are still highly recognizable. Intra-
InstaHide alone ($k=4$ or $k=6$) gives a bit better defending performance than
MixUp and GradPrune. Combining InstaHide ($k=4$) with gradient pruning
($p=0.99$) further improves the defense and makes the reconstruction almost
unrecognizable.

###  A.4 More results for encoding-based defenses

We visualize the whole reconstructed dataset under MixUp and Intra-InstaHide
defenses with different batch sizes in Figure 10, 11 and 12. Sample results of
the original and the reconstructed batches are provided in Figure 9.

Figure 9: Original and reconstructed batches of 16 images under MixUp and
Intra-InstaHide defenses. We visualize both the original and the absolute
images for the Intra-InstaHide defense. Intra-InstaHide makes pixel-wise
matching harder.

(a) Original

(b) MixUp, $k$=4

(c) MixUp, $k$=6

(d) MixUp+GradPrune, $k$=4, $p$=0.9

(e) Original

(f) InstaHide, $k$=4

(g) InstaHide, $k$=6

(h) InstaHide+GradPrune, $k$=4, $p$=0.9

Figure 10: Reconstrcuted dataset under MixUp and Intra-InstaHide against the
strongest attack (batch size is 1).

(a) Original

(b) MixUp, $k$=4

(c) MixUp, $k$=6

(d) MixUp+GradPrune, $k$=4, p=0.9

(e) Original

(f) InstaHide, $k$=4

(g) InstaHide, $k$=6

(h) InstaHide+GradPrune, $k$=4, $p$=0.9

Figure 11: Reconstrcuted dataset under MixUp and Intra-InstaHide against the
strongest attack (batch size is 16).

(a) Original

(b) MixUp, $k$=4

(c) MixUp, $k$=6

(d) MixUp+GradPrune, $k$=4, $p$=0.9

(e) Original

(f) InstaHide, $k$=4

(g) InstaHide, $k$=6

(h) InstaHide+GradPrune, $k$=4, $p$=0.9

Figure 12: Reconstrcuted dataset under MixUp and Intra-InstaHide against the
strongest attack (batch size is 32).

##  Appendix B Theoretical Insights for Defenses’ Working Mechanism

In this section, we provide some theoretical insights for the mechanism of
each defense.

###  B.1 Gradient pruning

Gradient pruning is a non-oblivious case of applying sketching techniques
[Cohen et al., 2019] to compress the gradient vector. Usually, if we only
observe the vector after sketching, it is hard to recover the original vector
unless certain assumptions of the vector itself and the sketching technique
have been made. Therefore, gradient pruning prevents the attacker from seeing
the original gradient and make the inversion harder.

###  B.2 MixUp and InstaHide

Intuitively, MixUp and InstaHide’s working mechanism may come from mixing $k$
images in a single encoded image, which appears to be similar to multiplying
the batch size by a factor of $k$, thus makes the attack less effective. In
Section B.3, we provide theoretical analysis for this intuition, by showing
that mixing $k$ images and using a batch size of $k$ are essentially similar,
with any neural network that has a fully connected layer as its first layer.

Another layer of security of InstaHide seems to come from applying random
sign-flipping on the mixed images. As mentioned in Section 5.1, for an
InstaHide-encoded image $x\in\operatorname{{\mathbb{R}}}^{d}$, we apply the
total variation regularizer on $|x|$ instead of $x$, which pushes the gap
between absolute value of adjacent pixels (i.e., $||x_{j}|-|x_{j+1}||$) to be
small. However having $||x_{j}|-|x_{j+1}||=\delta$ for some small
$\delta<10^{-4}$ does not imply that $|x_{j}-x_{j+1}|=\delta$; in fact,
$|x_{j}-x_{j+1}|$ can be as large as $1-\delta$. Therefore, the random sign
flipping operation in InstaHide could potentially make the total variation
image prior less effective in some sense (see Figure 9).

###  B.3 Property of gradient in a small batch

The goal of this section is to present the following results,

######  Lemma B.1.

Given a neural network with ReLU activation function, each row of the gradient
of first layer weights is a linear combination of images, i.e.

$\displaystyle(\frac{\partial{\cal L}(W)}{\partial
W_{1}})_{i}=\sum_{j=1}^{b}\alpha_{i,j}x_{i}^{\top}$

where the $b$ is the number of images in a small batch,
$\\{x_{1},\cdots,x_{b}\\}\in\operatorname{{\mathbb{R}}}^{d}$ are images in
that small batch.

In Section B.4 and B.5, we show the above observation holds for one/two-hidden
layer neural network. In Section B.6, we generalize it to multiple layer
neural network.

The standard batched $k$-vector sum can be defined as follows:

######  Definition B.2.

Give a database $X$ list of vectors $x_{1},\cdots,x_{n}$. Given a list of
observations $y_{1},\cdots,y_{m}$ where for each $j\in[m]$, there is a set
$S_{j}$ such that $y_{j}=\sum_{i\in S_{j}}x_{i}$ and $|S_{j}|=b$. We can
observe $y_{1},\cdots y_{m}$ but has no access to database, the goal is to
recover $S_{j}$ and the vectors $x_{i}$ being use, for each $j$.

The above definition is a mathematical abstraction of MixUp recovery/attack.
It can be further generalized to InstaHide, if we only observe the $|y_{j}|$.
We also want to remark that in the above definition, we simplify the
formulation by using coefficients $1$ for all vectors. It can be easily
generalized to settings where random coefficients are assigned to vectors in
the database for MixUp/InstaHide.

Using Lemma B.1, we notice that

######  Lemma B.3.

Under the condition of Lemma B.1, given a list of observation of gradients,
and the problem recovering images is also a batched vector sum problem.

Thus, gradient attack is essentially an variation of MixUp/Instahide attack.

###  B.4 One Hidden Layer

We consider a one-hidden layer ReLU activated neural network with $m$ neurons
in the hidden layer:

$\displaystyle f(x)=a^{\top}\phi(Wx)$

where $a\in\operatorname{{\mathbb{R}}}^{m}$ and
$W\in\operatorname{{\mathbb{R}}}^{m\times d}$. We define objective function
$L$ as follows:

$\displaystyle L(W)=\frac{1}{2}\sum_{i=1}^{n}(y_{i}-f(W,x_{i},a))^{2}$

We can compute the gradient of $L$ in terms of $w_{r}$

$\displaystyle\frac{\partial L(W)}{\partial
w_{r}}=\sum_{i=1}^{n}(f(W,x_{i},a)-y_{i})a_{r}x_{i}{\bf 1}_{\langle
w_{r},x_{i}\rangle}$

Let $\widetilde{x}=\frac{1}{n}\sum_{i=1}^{n}x_{i}$,

$\displaystyle\frac{\partial L(W)}{\partial
w_{r}}=(f(W,\widetilde{x},a)-y)a_{r}\widetilde{x}{\bf 1}_{\langle
w_{r},\widetilde{x}\rangle}$

Another version

$\displaystyle\frac{\partial L(W)}{\partial
w_{r}}=\sum_{i=1}^{n}(f(W,x_{i},a)-y_{i})\cdot\Big{(}a_{r}\widetilde{x}{\bf
1}_{\langle w_{r},\widetilde{x}\rangle}\Big{)}$

###  B.5 Two Hidden Layers

Suppose $a\in\operatorname{{\mathbb{R}}}^{m}$,
$V\in\operatorname{{\mathbb{R}}}^{m\times
d},W\in\operatorname{{\mathbb{R}}}^{m\times m}$. The neural network is defined
as $f:\operatorname{{\mathbb{R}}}^{d}\rightarrow\operatorname{{\mathbb{R}}}$,
here we slightly deviate from the standard setting and assume the input
dimension is $m$, in order to capture the general setting.

$\displaystyle f(x)=a^{\top}\phi(W\phi(Vx))$

Consider the mean square loss

$\displaystyle L(W,V,a)=\frac{1}{2}\sum_{i=1}^{n}|f(x_{i})-y_{i}|^{2}$

The gradient with respect to $W$ is

$\displaystyle\frac{\partial L(W,V,a)}{\partial
W}=\sum_{i=1}^{n}(f(x_{i})-y_{i})\underbrace{\mathrm{diag}\\{\phi^{\prime}(W\phi(Vx_{i}))\\}}_{m\times
m}\underbrace{a}_{m\times 1}\underbrace{\phi(Vx_{i})^{\top}}_{1\times m}$

and the gradient with respect to $V$ is

$\displaystyle\frac{\partial L(W,V,a)}{\partial
V}=\sum_{i=1}^{n}(f(x_{i})-y_{i})\underbrace{\mathrm{diag}\\{\phi^{\prime}(Vx_{i})\\}}_{m\times
m}\underbrace{W^{\top}}_{m\times
m}\underbrace{\mathrm{diag}\\{\phi^{\prime}(W\phi(Vx_{i}))\\}}_{m\times
m}\underbrace{a}_{m\times 1}\underbrace{x_{i}^{\top}}_{1\times d}$

###  B.6 The multi-layers case

The following multiple layer neural network definition is standard in
literature.

Consider a $L$ layer neural network with one vector
$a\in\operatorname{{\mathbb{R}}}^{m_{L}}$ and $L$ matrices
$W_{L}\in\operatorname{{\mathbb{R}}}^{m_{L}\times m_{L-1}}$, $\cdots$,
$W_{2}\in\operatorname{{\mathbb{R}}}^{m_{2}\times m_{1}}$ and
$W_{1}\in\operatorname{{\mathbb{R}}}^{m_{1}\times m_{0}}$. Let $m_{0}=d$. In
order to write gradient in an elegant way, we define some artificial variables
as follows

$\displaystyle g_{i,1}=$ $\displaystyle~{}W_{1}x_{i},$ $\displaystyle
h_{i,1}=\phi(W_{1}x_{i}),$
$\displaystyle\in\operatorname{{\mathbb{R}}}^{m_{1}}$ $\displaystyle\forall
i\in[n]$ $\displaystyle g_{i,\ell}=$ $\displaystyle~{}W_{\ell}h_{i,\ell-1},$
$\displaystyle h_{i,\ell}=\phi(W_{\ell}h_{i,\ell-1}),$
$\displaystyle\in\operatorname{{\mathbb{R}}}^{m_{\ell}}$ $\displaystyle\forall
i\in[n],\forall\ell\in\\{2,3,\cdots,L\\}$ (4) $\displaystyle D_{i,1}=$
$\displaystyle~{}\text{diag}\big{(}\phi^{\prime}(W_{1}x_{i})\big{)},$
$\displaystyle\in\operatorname{{\mathbb{R}}}^{m_{1}\times m_{1}}$
$\displaystyle\forall i\in[n]$ $\displaystyle D_{i,\ell}=$
$\displaystyle~{}\text{diag}\big{(}\phi^{\prime}(W_{\ell}h_{i,\ell-1})\big{)},$
$\displaystyle\in\operatorname{{\mathbb{R}}}^{m_{\ell}\times m_{\ell}}$
$\displaystyle\forall i\in[n],\forall\ell\in\\{2,3,\cdots,L\\}$

where $\phi(\cdot)$ is the activation function and $\phi^{\prime}(\cdot)$ is
the derivative of activation function.

Let
$f:\operatorname{{\mathbb{R}}}^{m_{0}}\rightarrow\operatorname{{\mathbb{R}}}$
denote neural network function:

$\displaystyle f(W,x)=a^{\top}\phi(W_{L}(\phi(\cdots\phi(W_{1}x))))$

Thus using definition of $f$ and $h$, we have

$\displaystyle
f(W,x_{i})=a^{\top}h_{i,L},~{}~{}~{}\in\operatorname{{\mathbb{R}}},~{}~{}~{}\forall
i\in[n]$

Given $n$ input data points
$(x_{1},y_{1}),(x_{2},y_{2}),\cdots(x_{n},y_{n})\in\operatorname{{\mathbb{R}}}^{d}\times\operatorname{{\mathbb{R}}}$.
We define the objective function $\mathcal{L}$ as follows

$\displaystyle\mathcal{L}(W)=\frac{1}{2}\sum_{i=1}^{n}(y_{i}-f(W,x_{i}))^{2}.$

We can compute the gradient of ${\cal L}$ in terms of
$W_{\ell}\in\operatorname{{\mathbb{R}}}^{m_{\ell}\times m_{\ell-1}}$, for all
$\ell\geq 2$

$\displaystyle\frac{\partial\mathcal{L}(W)}{\partial
W_{\ell}}=\sum_{i=1}^{n}(f(W,x_{i})-y_{i})\underbrace{D_{i,\ell}}_{m_{\ell}\times
m_{\ell}}\left(\prod_{k=\ell+1}^{L}\underbrace{W_{k}^{\top}}_{m_{k-1}\times
m_{k}}\underbrace{D_{i,k}}_{m_{k}\times
m_{k}}\right)\underbrace{a}_{m_{L}\times
1}\underbrace{h_{i,\ell-1}^{\top}}_{1\times m_{\ell-1}}$ (5)

Note that the gradient for $W_{1}\in\operatorname{{\mathbb{R}}}^{m_{1}\times
m_{0}}$ (recall that $m_{0}=d$) is slightly different and can not be written
by general form. Here is the form

$\displaystyle\frac{\partial\mathcal{L}(W)}{\partial
W_{1}}=\sum_{i=1}^{n}(f(W,x_{i})-y_{i})\underbrace{D_{i,1}}_{m_{1}\times
m_{1}}\left(\prod_{k=2}^{L}\underbrace{W_{k}^{\top}}_{m_{k-1}\times
m_{k}}\underbrace{D_{i,k}}_{m_{k}\times
m_{k}}\right)\underbrace{a}_{m_{L}\times 1}\underbrace{x_{i}^{\top}}_{1\times
m_{0}}$ (6)


# On the Baire class of n-Dimensional Boundary Functions

Connor Paul Wilson  530 Church Street Ann Arbor, MI 48109<EMAIL_ADDRESS>
###### Abstract.

We show an extention of a theorem of Kaczynski to boundary functions in
n-dimensional space. Let $H$ denote the upper half-plane, and let $X$ denote
its frontier, the $x$-axis. Suppose that $f$ is a function mapping $H$ into
some metric space $Y.$ If $E$ is any subset of $X,$ we will say that a
function $\varphi:E\rightarrow Y$ is a boundary function for $f$ if and only
if for each $x\in E$ there exists an arc $\gamma$ at $x$ such that
$\lim_{z\rightarrow x\atop z\in\gamma}f(z)=\varphi(x)$

##  1\. Introduction

###  1.1. Preliminaries and Notation

Let $H$ denote the upper half-plane, and let $X$ denote its frontier, the
$x$-axis. If $x\in X,$ then by an arc at $x$ we mean a a simple arc $\gamma$
with one endpoint at $x$ such that $\gamma-\\{x\\}\subseteq H.$ Suppose that
$f$ is a function mapping $H$ into some metric space $Y.$ If $E$ is any subset
of $X,$ we will say that a function $\varphi:E\rightarrow Y$ is a boundary
function for $f$ if and only if for each $x\in E$ there exists an arc $\gamma$
at $x$ such that

$\lim_{z\rightarrow x\atop z\in\gamma}f(z)=\varphi(x)$

We will also define Baire classes as Kaczynski does in [1], such that a
function $f:M\rightarrow Y$ is said to be of Baire class $O(M,Y)$ if and only
if it is continuous; if $\xi$ is an ordinal number greater than or equal to
$1,$ then f is said to be of Baire class $\xi(M,Y)$ if and only if there
exists a sequence of functions $\left\\{f_{n}\right\\}_{n=1}^{\infty}$ mapping
M into $Y,f_{n}$ being of Baire class $\eta_{n}(M,Y)$ for some $\eta_{n}<\xi$,
such that $f_{n}\rightarrow f$ pointwise.

##  2\. Boundary functions for discontinuous functions

######  Theorem 2.1.

Let $Y$ be a separable arc-wise connected metric space, with $f:H\rightarrow
Y$ a function of Baire class $\xi(H,Y)$ where $\xi\geq 1,$ $E$ a subset of
$X$, and $\varphi:E\rightarrow Y$ a boundary function for $f$. Therefore
$\varphi$ is of Baire class $\xi+1(E,Y).$

###### Proof.

Let $U$ be an open subset of $Y$ such that $V=Y-\operatorname{clos}(U)$. Set
$A=\varphi^{-1}(U),\ B=\varphi^{-1}(V),\ C=A\cup B.$ Notice that we clearly
have an empty intersection between $A$ and $B$. $\forall x\in C$, choose an
arc $\gamma_{x}$ at $x$ such that:

$\lim_{z\rightarrow x\atop z\in\gamma_{x}}f(z)=\varphi(x)$

with

$\gamma_{x}\subseteq\\{z:\mid z-x\mid\leq 1\\}$

where

$\begin{cases}\gamma_{x}-\\{x\\}\subseteq f^{-1}(U)&\text{ if }x\in A\\\
\gamma_{x}-\\{x\\}\subseteq f^{-1}(V)&\text{ if }x\in B\end{cases}$

Note once again the empty intersection $\gamma_{x}\cap\gamma_{y}=\emptyset$
for $x\in A\ \wedge\ y\in B$

Let us define the terminology $\gamma_{x}$ meets $\gamma_{y}$ in
$\operatorname{clos}(H_{n})$ provided that the two arcs have respective
subarcs, $\gamma_{x}\prime$ and $\gamma_{y}\prime$ with
$x\in\gamma_{x}\prime\subseteq\operatorname{clos}(H_{n})$ and
$x\in\gamma_{y}\prime\subseteq\operatorname{clos}(H_{n})$, with
$\gamma_{x}\prime\cap\gamma_{y}\prime\neq\varnothing$

Let:

$L_{a}:={x\in A:\forall n\exists y,\text{ such that }y\in C,\ y\neq x,\
\gamma_{y}\text{ meets }\gamma_{x}\text{ in }\operatorname{clos}(H_{n})}$
$L_{b}:={x\in B:\forall n\exists y,\text{ such that }y\in C,\ y\neq x,\
\gamma_{y}\text{ meets }\gamma_{x}\text{ in }\operatorname{clos}(H_{n})}$
$M_{a}:={x\in A:\exists n,\gamma_{x}\text{ meets no }\gamma_{y}\text{ in
}\operatorname{clos}(H_{n})}$ $M_{b}:={x\in B:\exists n,\gamma_{x}\text{ meets
no }\gamma_{y}\text{ in }\operatorname{clos}(H_{n})}$ $L=L_{a}\cup L_{b}$
$M=M_{a}\cup M_{b}$

$L_{a},L_{b},M_{a},$ and $M_{b}$ are notably pairwise disjoint, and
$A=L_{a}\cup M_{a},$ $B=L_{b}\cup M_{b}.$

Let $n(x)\in\mathbb{Z}^{+}$ for each $x\in M$ such that $\gamma_{x}$ meets no
$\gamma_{y}$ in $\operatorname{clos}(H_{n(x)})$ such that $x\neq y,$ where
$n\geq n(x)$ gives the obvious no meeting case in
$\operatorname{clos}(H_{n})$. Moreover, take

$K_{n}:=\\{x\in C:\gamma_{x}\text{ meets }X_{n}\wedge\text{ if }x\in M,n\geq
n(x)\\}$

It is clear that we have for every $n,K_{n}\subseteq K_{n+1}$, as well as
$C=\bigcup_{n=1}^{\infty}K_{n}.$ It follows by the work of Kaczynski[1] and
the following lemma that we have Theorem $2.1$.

######  Lemma 2.2.

Let Y be a separable arc-wise connected metric space, E any metric space, and
$\varphi:E\rightarrow Y$ a function such that for every open set $U\subseteq
Y$ there exists a set $T\in P^{\xi+1}(E)$ where $\varphi^{-1}(U)\subseteq
T\subseteq\varphi^{-1}(\operatorname{clos}(U))$. Thus for $\xi\geq 2,$
$\varphi$ is of Baire class $\xi(E,Y).$

###### Proof.

Let $\mathcal{B}$ be a countable base for $Y,$ and suppose $W$ is some open
subset of $Y.$ Let:

$\mathcal{A}(W)=\\{U\in\mathcal{B}:\operatorname{clos}(U)\subseteq W\\}$

By Kaczynski, we take:

$W=\bigcup_{U\in\mathcal{A}(W)}U=\bigcup_{U\in\mathcal{A}(W)}\operatorname{clos}(U).$

$\forall U\in\mathcal{B},$ let $T(U)\in P^{\xi+1}(E)$ be chosen so that
$\varphi^{-1}(U)\subseteq T(U)\subseteq\varphi^{-1}(\operatorname{clos}(U)).$
Thus we have:

$\displaystyle\varphi^{-1}(W)$
$\displaystyle=\bigcup_{U\in\mathcal{A}(W)}\varphi^{-1}(U)\subseteq\bigcup_{U\in\mathcal{A}(W)}T(U)$
$\displaystyle\subseteq\bigcup_{U\in\mathcal{A}(W)}\varphi^{-1}(\operatorname{clos}(U))=\varphi^{-1}(W).$

Therefore $\varphi^{-1}(W)=\bigcup_{U\in\mathcal{A}(W)}T(U)$, and given
$P^{\xi+1}(E)$ is closed under countable unions, we have $\varphi^{-1}(W)\in
P^{\xi+1}(E),$ and $\varphi$ is of Baire class $\xi(E,Y)$ ∎

And following from above we therefore have:

$\varphi^{-1}(U)=A\subseteq T\cap E\subseteq
E-B=E-\varphi^{-1}(V)=\varphi^{-1}(\operatorname{clos}(U))$

for some $T\in P^{\xi+2}(X)$, and we know $T\cap E\in P^{\xi+2}(E)$ which by
the above lemma gives us $\varphi$ of Baire class $\xi+1(E,Y).$ ∎

##  3\. Sets of curvilinear convergence for $\mathbb{R}^{3}$

Let $f:H\rightarrow Y$ of Baire class $\xi(H,Y)$, and $\varphi:E\rightarrow Y$
a boundary function of $f.$ Let us define some function to analyse the
properties of $M_{a},$ following Kaczynski. Take
$\pi:\mathbb{R}^{3}\rightarrow\mathbb{R}^{2}$ such that

$\pi(\langle x,y,z\rangle)=\left\|\langle x,y\rangle\right\|_{2}.$

If $\left\|\langle x,y\rangle\right\|_{2}\in M\cap K_{n},$ then let us define
$p_{n}(\left\|\langle x,y\rangle\right\|_{2})$ as the first point of $X_{n}$
reached along $\gamma_{x}$ starting from $x.$ It is clear thus that by
Kaczynski, the function $\pi(p_{n}(\left\|\langle x,y\rangle\right\|_{2})$ is
strictly increasing on $M\cap K_{n}.$ Thus by the above logic, and Lemma
$2.2$, we can show the following theorem:

######  Theorem 3.1.

Let $Y$ be a separable arc-wise connected metric space in $\mathbb{R}^{n}$,
with $f:H\rightarrow Y$ a function of Baire class $\xi+n-1(H,Y)$ where
$\xi\geq 1,$ $E$ a subset of $X$, and $\varphi:E\rightarrow Y$ a boundary
function for $f$. Therefore $\varphi$ is of Baire class $\xi+n(E,Y).$

Although this does not resolve the fourth open problem of Kaczynski’s work, it
does provide an extension to a theorem shown, and is valuable nonetheless to
the field.

## References

  * [1] Kaczynski, Theodore J., Boundary functions, Doctoral Dissertation, University of Michigan (1967).