Abstract:Federated learning (FL) enables multiple local clients to collaboratively train a global model, which can reduce privacy leakage by sharing model parameters instead of private datasets. However, recent works have revealed that gradient-based data reconstruction attacks, e.g., deep leakage from gradients (DLG), improved DLG (iDLG), and inverting gradients (IG), may still reveal private information by exploiting model parameters from a local client. Current privacy-preserving FL strategies, e.g., differential privacy or gradient compression, can handle such attacks to some extent, but seriously sacrifice their model accuracy. In this work, we propose a novel privacy-preserving FL method, named privacy-encoded FL (PEFL), to combat such data reconstruction attacks without degrading the model performance. The key concept of PEFL is that each large weight matrix of the neural network model is decomposed into multiple cascading sub-matrices, which thus establishes a novel privacy-encoded mechanism by introducing an entangling nonlinear mapping between model gradients and raw data. As such, multiple sub-matrices are directly trained in parallel at the local clients, but only partial sub-matrices are reported to a global server, which suffices to reconstruct the global model whilst increasing the complexity of the coupling between the model parameters and raw data. We provide a detailed analysis of the accuracy, security, and complexity of our method. As shown, it breaks the limit of classical defensive methods, by significantly reducing the risk of data reconstruction attacks yet not degrading the model performance. Compared to classical defenses, the proposed PEFL decreases the peak-signal-to-noise ratio (PSNR) between the reconstructed data and the raw data by ~ 20dB, without sacrificing the test accuracy. As a new paradigm for privacy-preserving FL, our proposed method has great potential in privacy-demanding learning applications.

Defending Against Data Reconstruction Attacks in Federated Learning: An Information Theory Approach

Understanding Data Reconstruction Leakage in Federated Learning from a Theoretical Perspective

Privacy-Preserving Federated Learning Against Label-Flipping Attacks on Non-IID Data

Privacy Attack in Federated Learning is Not Easy: An Experimental Study

Practical Attribute Reconstruction Attack Against Federated Learning

Defending against Reconstruction Attack in Vertical Federated Learning

Hidden Data Privacy Breaches in Federated Learning

Privacy-Encoded Federated Learning Against Gradient-Based Data Reconstruction Attacks.

FedDAA: a robust federated learning framework to protect privacy and defend against adversarial attack

Provable Defense against Privacy Leakage in Federated Learning from Representation Perspective

Data Distribution Inference Attack in Federated Learning Via Reinforcement Learning Support

Membership Inference Defense in Distributed Federated Learning Based on Gradient Differential Privacy and Trust Domain Division Mechanisms

Practical Private Aggregation in Federated Learning Against Inference Attack

Federated Regularization Learning: an Accurate and Safe Method for Federated Learning

Robust Federated Learning Mitigates Client-side Training Data Distribution Inference Attacks

Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning

Federated Learning Attack Surface: Taxonomy, Cyber Defences, Challenges, and Future Directions

Federated Learning Privacy: Attacks, Defenses, Applications, and Policy Landscape - A Survey

Privacy and Robustness in Federated Learning: Attacks and Defenses

Towards Adaptive Privacy Protection for Interpretable Federated Learning

Defending against gradient inversion attacks in federated learning via statistical machine unlearning