Abstract:Although federated learning improves privacy of training data by exchanging local gradients or parameters rather than raw data, the adversary still can leverage local gradients and parameters to obtain local training data by launching reconstruction and membership inference attacks. To defend against such privacy attacks, many noises perturbed methods (like differential privacy or CountSketch matrix) have been widely designed. However, the strong defence ability and high learning accuracy of these schemes cannot be ensured at the same time, which will impede the wide application of FL in practice (especially for medical or financial institutions that require both high accuracy and strong privacy guarantee). To overcome this issue, we propose an efficient model perturbation method for federated learning to defend against reconstruction and membership inference attacks launched by curious clients. On the one hand, similar to the differential privacy, our method also selects random numbers as perturbed noises added to the global model parameters, and thus it is very efficient and easy to be integrated in practice. Meanwhile, the random selected noises are positive real numbers and the corresponding value can be arbitrarily large, and thus the strong defence ability can be ensured. On the other hand, unlike differential privacy or other perturbation methods that cannot eliminate added noises, our method allows the server to recover the true aggregated gradients by eliminating the added noises. Therefore, our method does not hinder learning accuracy at all. Extensive experiments demonstrate that for both regression and classification tasks, our method achieves the same accuracy as non-private approaches and outperforms the state-of-the-art defence schemes. Besides, the defence ability of our method against reconstruction and membership inference attack is significantly better than the state-of-the-art related defence schemes.

Protecting Regression Models with Personalized Local Differential Privacy

Monitoring-based Differential Privacy Mechanism Against Query-Flooding Parameter Duplication Attack

Protection Against Reconstruction and Its Applications in Private Federated Learning

Accurate, Explainable, and Private Models: Providing Recourse While Minimizing Training Data Leakage

An Accuracy-Lossless Perturbation Method for Defending Privacy Attacks in Federated Learning

Differential Privacy Protection Against Membership Inference Attack on Machine Learning for Genomic Data

Functional Mechanism: Regression Analysis under Differential Privacy

Differentially private regression analysis with dynamic privacy allocation

Not Just Cloud Privacy: Protecting Client Privacy in Teacher-Student Learning

Utility–Privacy Trade-Off in Distributed Machine Learning Systems

Mitigating Sybil Attacks on Differential Privacy based Federated Learning

SPM-FL: A Federated Learning Privacy-Protection Mechanism Based on Local Differential Privacy

Adaptive Differential Privacy Mechanism Based on Entropy Theory for Preserving Deep Neural Networks

Too Good to be True? Turn Any Model Differentially Private With DP-Weights

Augment then Smooth: Reconciling Differential Privacy with Certified Robustness

Differentially Private Log-Location-Scale Regression Using Functional Mechanism

One Parameter Defense -- Defending against Data Inference Attacks via Differential Privacy

Personalized Differential Privacy for Ridge Regression

Optimal Differentially Private Model Training with Public Data

Noise-Aware Differentially Private Regression via Meta-Learning

Fuzzy Prediction Model in Privacy Protection: Takagi-Sugeno Rules Model Via Differential Privacy