Peak Signal-to-Noise Ratio (PSNR)

PSNR expresses reconstruction error on a logarithmic decibel (dB) scale, where higher values indicate better fidelity. This scaling mirrors human perception of large dynamic ranges better than raw error counts.

• Mathematical basis: Derived from the Mean Squared Error (MSE) between the original image I and the reconstruction K.
• Formula: PSNR = 10 * log10(MAX_I² / MSE)
• MAX_I: The maximum possible pixel value (e.g., 255 for 8-bit images).
• Interpretation: A PSNR of 40 dB typically indicates a near-lossless reconstruction, while values below 20 dB suggest severe degradation.

In gradient leakage research, PSNR provides a standardized, reproducible metric to compare the efficacy of different inversion attacks against various defensive mechanisms.

• Attack comparison: Researchers report PSNR to demonstrate how closely a Deep Leakage from Gradients (DLG) attack recovers original training samples.
• Defense evaluation: A significant drop in PSNR after applying gradient perturbation or gradient pruning quantifies the defense's effectiveness.
• Thresholds: A PSNR above 30 dB is generally considered a high-fidelity breach, revealing recognizable faces or text.

PSNR operates strictly on pixel-wise error and often fails to correlate with human visual perception, making it an incomplete measure of privacy risk.

• Ignoring structure: Two images with identical PSNR can look drastically different if the noise pattern disrupts textures but not luminance.
• Complementary metrics: Modern research pairs PSNR with Structural Similarity Index (SSIM) and Learned Perceptual Image Patch Similarity (LPIPS).
• LPIPS advantage: LPIPS uses deep neural network features to judge similarity, catching semantic leakage that PSNR misses.

PSNR effectively models the signal-to-noise ratio of the reconstruction process, framing the original image as the 'signal' and the inversion error as the 'noise'.

• Adversarial context: The attacker's optimization process (e.g., gradient matching) minimizes the noise term.
• Defensive context: Defenses like Differential Privacy (DP) inject calibrated noise to degrade the PSNR below a usable threshold.
• Privacy budget link: A lower privacy budget (epsilon) in DP-SGD directly correlates with a lower PSNR in reconstructed images.

Unlike learned metrics, PSNR is fast to compute and deterministic, making it ideal for monitoring reconstruction quality during the iterative optimization of a gradient inversion attack.

• Loss function: Attackers often use Mean Squared Error (MSE) as the primary loss function, which directly optimizes for PSNR.
• No GPU overhead: Calculating PSNR requires only basic arithmetic, avoiding the memory footprint of running a secondary neural network for evaluation.
• Debugging tool: It provides a direct, interpretable signal for tuning learning rates in the inversion process.

PSNR is highly sensitive to the dynamic range of the input data, requiring careful normalization when comparing results across different datasets or preprocessing pipelines.

• Normalization impact: If images are normalized to [0, 1] instead of [0, 255], the MAX_I term changes, drastically altering the dB calculation.
• Reproducibility: Privacy papers must explicitly state the data range used to ensure PSNR values are comparable.
• Batch effects: Comparing PSNR across datasets like CIFAR-10 (low resolution) and ImageNet (high resolution) requires contextualization due to differing pixel complexities.