{"id":17719839,"url":"https://github.com/zjysteven/privacyattack_at_fl","last_synced_at":"2025-09-04T18:43:17.217Z","repository":{"id":156562233,"uuid":"461936172","full_name":"zjysteven/PrivacyAttack_AT_FL","owner":"zjysteven","description":"A privacy attack that exploits Adversarial Training models to compromise the privacy of Federated Learning systems.","archived":false,"fork":false,"pushed_at":"2022-07-07T21:09:12.000Z","size":3238,"stargazers_count":8,"open_issues_count":0,"forks_count":2,"subscribers_count":1,"default_branch":"main","last_synced_at":"2023-04-26T19:24:03.545Z","etag":null,"topics":["adversarial-machine-learning","adversarial-robustness","adversarial-training","federated-learning","privacy"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/zjysteven.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-02-21T16:10:03.000Z","updated_at":"2023-03-09T20:26:42.000Z","dependencies_parsed_at":null,"dependency_job_id":"ee77bf7d-9bda-4c5f-92bc-bdc00c89fb2d","html_url":"https://github.com/zjysteven/PrivacyAttack_AT_FL","commit_stats":null,"previous_names":[],"tags_count":0,"template":null,"template_full_name":null,"purl":"pkg:github/zjysteven/PrivacyAttack_AT_FL","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zjysteven%2FPrivacyAttack_AT_FL","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zjysteven%2FPrivacyAttack_AT_FL/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zjysteven%2FPrivacyAttack_AT_FL/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zjysteven%2FPrivacyAttack_AT_FL/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/zjysteven","download_url":"https://codeload.github.com/zjysteven/PrivacyAttack_AT_FL/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/zjysteven%2FPrivacyAttack_AT_FL/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":273656427,"owners_count":25145001,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-04T02:00:08.968Z","response_time":61,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["adversarial-machine-learning","adversarial-robustness","adversarial-training","federated-learning","privacy"],"created_at":"2024-10-25T15:09:39.729Z","updated_at":"2025-09-04T18:43:17.167Z","avatar_url":"https://github.com/zjysteven.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Exploiting Adversarial Training models to compromise FL's privacy\n\nThis repository contains the code necessary to replicate the results of our paper:\n\n***Privacy Leakage of Adversarial Training Models in Federated Learning Systems***\n\n[*CVPR'22 Workshop: The Art of Robustness*](https://artofrobust.github.io/)\n\n[Jingyang Zhang](https://zjysteven.github.io/), Yiran Chen, Hai Li @ [Duke CEI Lab](https://cei.pratt.duke.edu/)\n\nCheck out the paper [here](https://openaccess.thecvf.com/content/CVPR2022W/ArtOfRobust/html/Zhang_Privacy_Leakage_of_Adversarial_Training_Models_in_Federated_Learning_Systems_CVPRW_2022_paper.html)!!!\n\n\n## Overview\n\u003cp align=\"center\"\u003e\n\u003cimg src='/figures/overview_new.png' width='550'\u003e\n\u003c/p\u003e\n\nAdversarial Training (AT) is crucial for obtaining deep neural networks that are robust to adversarial attacks, yet\nrecent works found that it could also make models more vulnerable to privacy attacks. In this work, we further reveal\nthis unsettling property of AT by designing a novel privacy attack that is practically applicable to the privacy-sensitive\nFederated Learning (FL) systems. **Using our method, the attacker can exploit AT models in the FL system to accurately reconstruct users’ private training images even when the training batch size is large,** despite that previously large batch training was thought to be able to protect the privacy. In other words, **we demonstrate that any FL clients that perform AT are putting their privacy at risk**. The above figure is an overview of our attack.\nSee our paper for details!\n\n\u003cp align=\"center\"\u003e\n\u003cimg src='/figures/demo.png' width='650'\u003e\n\u003c/p\u003e\nThis figure visualizes the reconstructed images using Adversarial Training models (first row in each pair) and the ground-truth ones. The attacker can pretty accurately recover the training images of FL clients and thus compromise their privacy.\n\n\n## Get started\n### Environment\nFollow the commands below to set up the environment.\n\n1. Clone the repo: `git clone https://github.com/zjysteven/PrivayAttack_AT_FL.git`\n\n2. Create a conda environment\n```\nconda create -n AT-privacy python=3.8\nconda activate AT-privacy\npython -m pip install -r requirements.txt\n```\n\n### Dataset\nWe use [ImageNet](https://www.image-net.org/) as the dataset. To run our experiments, make sure that you download the ImageNet and have `train/`, `val/` subfolder inside the root directory. \n\n### Models\nWe use pre-trained models from [robust-transfer](https://github.com/microsoft/robust-models-transfer) repo. `download_pretrained_models.sh` is a sample download script. \n\n## Reproducing experiments\nAll experiments can be reproduced by running `main.py`. We provide a sample script `main.sh`. Remember to change the directory of ImageNet to your own version.\n\n## Reference\nIf you find our work/code helpful, please consider citing our work.\n```\n@InProceedings{Zhang_2022_CVPR,\n    author    = {Zhang, Jingyang and Chen, Yiran and Li, Hai},\n    title     = {Privacy Leakage of Adversarial Training Models in Federated Learning Systems},\n    booktitle = {Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) Workshops},\n    month     = {June},\n    year      = {2022},\n    pages     = {108-114}\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzjysteven%2Fprivacyattack_at_fl","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fzjysteven%2Fprivacyattack_at_fl","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fzjysteven%2Fprivacyattack_at_fl/lists"}