PaperlayerView exact revision on arXiv

Source-linked AI summary

A Hybrid Approach to Privacy-Preserving Federated Learning

Stacey Truex, Nathalie Baracaldo, Ali Anwar, Thomas Steinke, Heiko Ludwig, Rui Zhang, Yi Zhou

arXiv:1812.03224v2cs.LGstat.ML

TL;DR

Federated learning must protect both exchanged training information and final-model outputs when organizations cannot share raw data. This paper combines differential privacy with secure multiparty computation and a tunable trust threshold, reporting accurate, private training across multiple model types and outperforming existing approaches. The main scope boundary is that privacy–accuracy parameter effects remain dependent on the data and chosen algorithm.

  • Problem

    Federated learning can leak private information during training and through model outputs, while local differential privacy may reduce performance.

  • Method

    The system combines differential privacy and secure multiparty computation with a tunable trust parameter to protect federated-learning data and outputs.

  • Results

    The approach outperforms existing federated-learning techniques and provides significant accuracy gains over naïve differentially private protocols across varied machine-learning models.

  • Takeaways & Limitations

    The combined approach supports end-to-end privacy guarantees for participants and model attackers across varying trust scenarios and learning approaches.

  • Takeaways & Limitations

    The impact of privacy, trust, and accuracy choices varies with the data and training algorithm, and algorithm-specific features affect the privacy budget.

Abstract

from arXiv · show

Federated learning facilitates the collaborative training of models without the sharing of raw data. However, recent attacks demonstrate that simply maintaining data locality during training processes does not provide sufficient privacy guarantees. Rather, we need a federated learning system capable of preventing inference over both the messages exchanged during training and the final trained model while ensuring the resulting model also has acceptable predictive accuracy. Existing federated learning approaches either use secure multiparty computation (SMC) which is vulnerable to inference or differential privacy which can lead to low accuracy given a large number of parties with relatively small amounts of data each. In this paper, we present an alternative approach that utilizes both differential privacy and SMC to balance these trade-offs. Combining differential privacy with secure multiparty computation enables us to reduce the growth of noise injection as the number of parties increases without sacrificing privacy while maintaining a pre-defined rate of trust. Our system is therefore a scalable approach that protects against inference threats and produces models with high accuracy. Additionally, our system can be used to train a variety of machine learning models, which we validate with experimental results on 3 different machine learning algorithms. Our experiments demonstrate that our approach out-performs state of the art solutions.

1 INTRODUCTION

Federated learning lets organizations collaborate without sharing raw data, but exchanged training information and final models can still leak private data. The proposed system combines formal privacy protections with tunable trust and supports accurate training across multiple model types.

  • Motivation: Federated learning enables organizations to collaborate on shared models without relying on a trusted third party to hold their data.Data holders train locally and exchange model parameters that are aggregated and redistributed.
  • Privacy gap: Model-parameter exchange alone does not prevent inference during learning or leakage from the resulting trained model.Information may be inferred from the learning process and traced back to its source in the final model.
  • Privacy gap: Local differential privacy can add enough noise to each participant’s parameters to produce poor model performance.This is especially problematic when privacy noise is applied separately to data from each node.
  • Contributions: The proposed system combines secure multiparty computation and differential privacy to provide formal privacy guarantees while improving accuracy over existing privacy-preserving approaches.It also accounts for inference by participants and collusion through a customizable trust threshold.
  • Contributions: The system supports decision trees, convolutional neural networks, and linear support vector machines, including private and accurate federated neural-network training.The evaluation covers three substantially different machine-learning models.

2 PRELIMINARIES

The paper introduces differential privacy, homomorphic encryption, and federated-learning privacy threats. It distinguishes leakage during training from leakage through intermediate outputs and the final predictive model.

  • Differential Privacy: Differential privacy limits how much including one individual can change an algorithm’s output, thereby restricting membership inference.Noise is calibrated to the output sensitivity, the maximum change caused by one data instance.
  • Differential Privacy: Differential privacy composes across multiple additive-noise mechanisms through basic or advanced composition theorems.These theorems determine the overall privacy guarantee when an algorithm applies several mechanisms.
  • Encryption: Additive homomorphic encryption lets untrusted parties operate on encrypted values while preserving the scheme’s aggregation property.The Paillier cryptosystem is presented as one such scheme, with a threshold variant that prevents subsets below a predefined threshold from decrypting.
  • FL Privacy Threats: Federated learning faces inference during training and inference over intermediate outputs and the final model.Insiders may infer another party’s data from exchanged responses, while model users may infer training information through black-box access.
  • FL Privacy Threats: Secure multiparty computation protects inputs during computation but does not hide information revealed by the unchanged function output.Differential privacy is therefore needed to address inference over outputs.
  • FL Privacy Threats: Federated-learning differential privacy is defined at the individual-record level rather than at the party level.A party may represent many individuals, but neighboring databases still differ by one record.

3.1 Threat Model

The threat model covers an aggregator, participating data parties, and outsiders, including collusion, protocol deviations, communication monitoring, and attacks on the deployed model. Secure channels and threshold encryption support the assumed protections.

  • Adversaries: The system is designed to withstand attacks by the aggregator, data parties, and outsiders.Outsiders include communication eavesdroppers and users of the final predictive model.
  • Adversaries: The baseline aggregator is honest-but-curious: it follows the learning protocol but attempts to infer private information from received data.This adversary does not vary from the predetermined machine-learning algorithm.
  • Trust: The trust parameter t specifies the minimum number of non-colluding parties, while participating parties may deviate from the protocol to obtain information.The model explicitly considers collusion involving parties and the aggregator.
  • Assumptions: Secure channels authenticate messages and prevent outsiders or malicious data parties from injecting responses.This assumption applies to communication between each party and the aggregator.
  • Assumptions: Threshold Paillier encryption ensures that any set of n − t or fewer parties cannot decrypt ciphertexts, protecting individual messages sent to the aggregator.The guarantee assumes secure key distribution and semantic security under the stated cryptographic assumption.

3.2 Proposed Approach

The proposed approach combines differential privacy with secure multiparty computation to answer federated-learning queries under a tunable trust threshold. Parties add calibrated noise, encrypt responses, and let the aggregator homomorphically aggregate them.

  • Design: The system combines secure multiparty computation and differential privacy to address inference during learning, inference over outputs, and trust.The stated design goal is privacy without sacrificing accuracy.
  • Design: The system takes a training algorithm, privacy guarantee ϵ, and trust threshold t as inputs alongside the parties’ disjoint datasets.The threshold specifies the minimum number of honest, non-colluding parties.
  • Query Processing: Each data-dependent training step is represented by a linear query Qs that every party answers using its local dataset.Queries may request locally trained model parameters or conventional statistics such as counts.
  • Query Processing: Participants add algorithm-dependent differential-privacy noise, encrypt responses with threshold Paillier, and send them to the aggregator for homomorphic aggregation.Noise depends on the step’s privacy budget, query sensitivity, and system trust level.
  • Trust and Accuracy: Collusion affects both noise calibration and the encryption threshold, while homomorphic encryption supports higher accuracy than local-privacy approaches.Noise added by honest participants must account for the information available to colluding parties.

3.3 Reducing Noise with SMC

The system uses SMC with a customizable trust parameter to reduce differential-privacy noise while preserving formal privacy guarantees. Encrypted aggregation and threshold decryption support this reduction, improving model accuracy.

  • SMC reduces noise while accounting for a customizable trust parameter.The trust parameter captures the system’s assumed number of honest, non-colluding parties.
  • Each party returns an encrypted query response containing its local computation and noise.The learning algorithm allocates privacy budget and noise according to the query step and trust setting.
  • Encrypted responses are homomorphically aggregated before selected parties provide partial decryptions.The aggregator combines ciphertexts, selects a decryption set of size ¯t, and reconstructs the aggregate from partial decryptions.
  • Each Yi is sampled from a Gaussian distribution whose standard deviation depends on the trust-adjusted noise parameter.The supplied method passage identifies Gaussian sampling and the trust-dependent standard deviation.
  • The decrypted aggregate contains more noise than required for differential privacy, while the encryption threshold prevents the maximum permitted colluders from decrypting honest parties’ values.These properties jointly preserve privacy under the stated trust condition.
  • Reducing noise while retaining customizable trust and formal privacy guarantees leads to more accurate machine-learning models.The paper explicitly connects the lower noise level to model accuracy.

4 EXPERIMENTAL EVALUATION

The evaluation applies the proposed system to decision trees, convolutional neural networks, and linear SVMs, examining accuracy, privacy-budget and party-count effects, noise, and encryption overhead. Across these experiments, the approach maintains strong accuracy, scales to distributed settings, and outperforms local differential privacy and other state-of-the-art methods.

  • The experiments evaluate decision trees, convolutional neural networks, and linear support vector machines.The study also analyzes how privacy budgets, party counts, trust, noise, and encryption affect performance.
  • Decision Trees: The approach maintains an F1-score above 0.8 for decision trees at privacy budgets as small as 0.4 and outperforms local DP across budgets until both reach random guessing.Performance degrades below a budget of 0.4 as noise overwhelms the information provided.
  • Convolutional Neural Networks: For CNN training with σ = 4, the approach reaches F1-score 0.957 versus 0.864 for local DP, and with σ = 2 reaches 0.963 versus 0.937.The approach shows the greatest gain at larger σ values, corresponding to tighter privacy guarantees.
  • Decision Trees: Encryption overhead remains relatively constant as party and parameter counts increase because encryption and decryption processes can run in parallel.Per-parameter encryption takes approximately 0.001095 seconds, while decryption takes 0.007112 seconds.
  • Overall Results: Across the evaluated models, the approach consistently outperforms state-of-the-art private federated-learning methods while remaining reasonably close to non-private settings.For SVM training, it achieves an F1-score over 0.87 and, with half the parties trusted, reaches 0.85 versus 0.75 for local DP after 100 epochs.

5 SYSTEM IMPLEMENTATION

The system adapts private federated training to decision trees, neural networks, SVMs, and additional algorithms by combining query-based aggregation, encrypted noisy responses, and tunable privacy parameters. Its implementation manages privacy budgets and trust thresholds while reducing deployment overhead and acknowledging algorithm-specific parameter trade-offs.

  • Algorithm integration: New training algorithms must be decomposed into summable queries, assigned portions of the overall privacy budget, and supported by every participating party.Each query is analyzed for privacy impact before implementation.
  • Decision trees: Decision-tree learning selects information-gain-maximizing features using noisy counts and class counts, then recursively builds child subtrees.Counts and class counts have sensitivity 1, and the privacy budget is divided across fixed iterations.
  • Neural networks: Neural-network training treats each party query as one local-learning epoch, averages updated model weights, and repeats for a predefined number of epochs.The process uses noisy parameters, sampling, clipping, and a privacy accountant.
  • Support vector machines: SVM training similarly averages model parameters after each query, with each query representing K local epochs and a predefined total epoch count controlling iteration.The objective is an ℓ2-regularized binary linear SVM with hinge loss.
  • System interface: The approach extends beyond the three evaluated models because parties return encrypted, noisy query responses and partial decryptions while the aggregator manages the global model.Threshold Paillier reduces the communication and encryption burden as more parties join.
  • Trade-offs: Privacy, trust, and accuracy depend on algorithm-specific choices such as feature and class counts, clipping norms, network size, and feature dimensionality.The effects of these parameters vary with the data and training algorithm.

6 RELATED WORK

Related work spans trusted aggregators, local differential privacy, and cryptographic protocols, but the paper distinguishes its system as an empirically evaluated private federated-learning solution for predictive model training. Prior approaches variously require trust, incur accuracy or communication costs, or address only narrower operations.

  • Trusted aggregators: Trusted-aggregator approaches expose plaintext or require a central party, while distributed DP systems have reported significant accuracy loss.Some trusted-aggregator systems do not address distributed data scenarios.
  • Local differential privacy: Local differential privacy avoids a central trusted party but can become ineffective for models with more than a small number of parameters.Its guarantee is described as applying per parameter.
  • Positioning: The paper contrasts its approach with prior systems by combining private aggregation and differential privacy for accurate federated predictive-model training.It reports empirical evaluation rather than only theoretical analysis or operation-specific protocols.
  • Cryptographic approaches: Cryptographic alternatives address private aggregation, distributed noise generation, or narrower data operations, but do not provide the paper’s complete predictive-model FL system.Some require extensive message exchange or leave integrated DP, secure aggregation, and deep learning beyond scope.
  • Threat models: A prior collaborative neural-network method combines MPC, DP, and secret sharing under non-colluding honest parties, whereas this system addresses active collusion.The comparison concerns the threat model assumed by the two approaches.

7 CONCLUSION

The paper presents end-to-end private federated learning by combining differential privacy with secure multiparty computation to protect models and exchanged messages across trust scenarios. It reports higher accuracy than existing approaches across multiple model types, while framing the system as a way to support privacy-sensitive deployment.

  • Contribution: Combining differential privacy and secure multiparty computation protects against model-extraction and collusion threats while providing formal privacy guarantees.Differential privacy covers model outputs and intermediate results, while SMC protects messages without DP protection.
  • Scope: The approach supports federated training of different machine-learning models under varying trust scenarios.The conclusion presents this flexibility as part of the system’s contribution.
  • Results: The system outperforms existing state-of-the-art federated-learning techniques and yields significant accuracy gains over a naïve application of state-of-the-art DP protocols.The reported evaluation covers a variety of machine-learning models.
  • Implications: The authors position the approach as enabling organizations to pursue high-performance machine learning while addressing privacy needs and regulatory compliance.This consequence is stated within the paper’s discussion of privacy-sensitive applications.
Loading 1812.03224v2…