PaperlayerView exact revision on arXiv

Source-linked AI summary

A Secure Federated Learning Framework for 5G Networks

Yi Liu, Jialiang Peng, Jiawen Kang, Abdullah M. Iliyasu, Dusit Niyato, Ahmed A. Abd El-Latif

arXiv:2005.05752v1cs.CRcs.LGcs.NI

TL;DR

Federated learning in 5G networks must address poisoning and membership inference attacks while preserving locally stored data. The paper proposes blockchain smart contracts and local differential privacy, and reports that the framework deters both attacks, with an accuracy–privacy tradeoff for differential privacy.

  • Problem

    Federated learning faces poisoning attacks that can undermine global models and membership inference attacks that can leak sensitive information.

  • Method

    The framework uses blockchain smart contracts to validate updates and identify unreliable participants, while local differential privacy adds Gaussian noise to uploaded updates.

  • Results

    Numerical results suggest the framework deters poisoning and membership inference attacks in federated learning for 5G networks.

  • Takeaways & Limitations

    The proposed framework improves the security of federated learning in 5G networks while local differential privacy sacrifices some model accuracy.

Abstract

from arXiv · show

Federated Learning (FL) has been recently proposed as an emerging paradigm to build machine learning models using distributed training datasets that are locally stored and maintained on different devices in 5G networks while providing privacy preservation for participants. In FL, the central aggregator accumulates local updates uploaded by participants to update a global model. However, there are two critical security threats: poisoning and membership inference attacks. These attacks may be carried out by malicious or unreliable participants, resulting in the construction failure of global models or privacy leakage of FL models. Therefore, it is crucial for FL to develop security means of defense. In this article, we propose a blockchain-based secure FL framework to create smart contracts and prevent malicious or unreliable participants from involving in FL. In doing so, the central aggregator recognizes malicious and unreliable participants by automatically executing smart contracts to defend against poisoning attacks. Further, we use local differential privacy techniques to prevent membership inference attacks. Numerical results suggest that the proposed framework can effectively deter poisoning and membership inference attacks, thereby improving the security of FL in 5G networks.

I. INTRODUCTION

The paper motivates secure federated learning in 5G networks by identifying privacy and reliability threats, then proposes blockchain smart contracts, local differential privacy, and a participant marketplace as defenses and incentives.

  • 5G networks reduce communication bottlenecks that previously limited mobile-device participation in distributed machine learning.
  • Centralized aggregation of private data can cause privacy leakage for users in 5G networks.
  • Federated learning keeps training datasets locally while devices train models and upload updates for central aggregation.
  • Poisoning attacks can cause global-model update failure, while membership inference attacks can expose information from intermediate gradients.
  • The proposed framework uses blockchain smart contracts to defend against poisoning and local differential privacy to mitigate membership inference attacks.
  • A marketplace lets participants benefit directly from their skills and uses incentives to encourage better federated learning models.

II. FEDERATED LEARNING AND ITS THREATS

This section presents federated learning as collaborative model training without centralized training data and describes representative 5G applications involving IoT and vehicles.

  • Federated learning builds models from datasets stored locally on distributed devices without requiring centralized training data.
  • Devices download a global model, train on local raw data, and upload gradient-based updates for aggregation.
  • Internet of Things (IoT): In 5G IoT scenarios, federated learning can support personalized voice assistants without compromising personal privacy.
  • Internet of Vehicles (IoV): In Internet-of-Vehicles scenarios, federated learning can build traffic-flow prediction models while avoiding direct trading of personal data.

B. Threats and Countermeasures

The paper identifies poisoning and sensitive-information disclosure as obstacles to federated-learning deployment, and counters them with blockchain contracts, evaluation, incentives, and local differential privacy.

  • Threat 1: Participants with malicious behaviors: Malicious or low-quality participant updates can poison aggregation and produce poor-accuracy or useless global models.
  • Threat 2: Disclosure of sensitive information: Uploaded model parameters can enable membership inference attacks that obtain sensitive information associated with local data.
  • A task publisher specifies a testing dataset, initial global model, accuracy criterion, and reward in a smart contract.
  • The Ethereum blockchain publishes contracts, while uploaded models are evaluated against contract criteria before qualifying models and payments are released.
  • Participants train locally, submit model updates through the blockchain, and use local differential privacy to defend against membership attacks.
  • The framework establishes an anonymous blockchain marketplace where honest participants can profit from correct solutions and update verification supports security.
  • Noise-adding mechanisms such as Gaussian or Laplace noise protect model parameters from recovery by adversaries accessing gradient information.

III. SECURE FEDERATED LEARNING FRAMEWORK

The secure framework defines blockchain marketplace roles and a three-phase training pipeline, combining smart contracts for poisoning defense with differential privacy for inference defense.

  • The framework models smart contracts, wallet addresses, task publishers, central aggregators, devices, local models, global models, and model updates as core components.
  • A data group is a matrix of data points, and the pipeline applies smart contracts against poisoning and local differential privacy against inference attacks.
  • Initialization: During initialization, a task publisher creates and publishes a contract containing evaluation data, an initial model, criteria, and rewards.
  • Aggregation: During aggregation, participants train on local datasets, submit updates, and blockchain miners evaluate update quality using the smart contract.
  • Update: The update phase provides the current global model for the next training round and rewards participants for high-accuracy updates.

A. Initialization Phase

The initialization phase creates and initializes the smart contract, verifies hashed testing data, and makes the global model and FL task available to devices.

  • The task publisher creates a smart contract and calls init() to initialize the SFL framework.
  • The number of training iterations is determined by the block size.
  • The task publisher hashes testing data groups and their indices, sends the hashed result as a random-number seed, and stores the reward in an encrypted address.
  • The central aggregator verifies testing data against the supplied hash and writes testing data groups and random numbers into the smart contract.
  • Devices retrieve the global model and FL task through get global model() and get FL task(), after which smart-contract initialization is complete.

B. Aggregation Phase

During aggregation, devices train local models, perturb updates with Gaussian noise for local differential privacy, submit them, and undergo central evaluation and aggregation.

  • Local model training: Each device trains a local model with local data using the local model training() function, with D-SGD assumed for updating local models.
  • Noise Addition: Gaussian Noise Mechanism perturbs local model updates before devices submit them to the central aggregator.
  • Noise Addition: The (ε, δ)-LDP method trades security against availability, while sensitivity S bounds the maximum absolute distance between function outputs.
  • Noise Addition: Devices scale updates so ||∆¯ωk||2 < S; dividing Gaussian-noise output by D approximates the average update while preventing leakage of crucial individual information.
  • Submission: Devices submit noise-added gradient information and a payee address through submit model update().
  • Evaluation: The aggregator stops accepting updates during evaluation, selects qualified devices, observes aggregation results, and then aggregates local model parameters.

C. Update Phase

The update phase finalizes the FL task after convergence or reaching the iteration limit, distributes rewards, posts results, and provides the task publisher with a new global model.

  • After convergence or the iteration limit, qualified devices call finalize contract() to obtain rewards from the Ethereum blockchain.
  • The central aggregator posts the FL task results through post evaluation(), and the task publisher obtains a new better global model.
  • The aggregation phase includes local training, Gaussian-noise addition, and submission of model updates.

IV. SOLUTIONS TO POTENTIAL ISSUES

The framework addresses trust and fairness concerns by considering potential marketplace issues where users might cheat or gain advantages over others.

  • Trust and fairness motivate additional solutions for potential issues in the proposed federated-learning marketplace.

A. Overfitting Problems

The framework is vulnerable to overfitting under noisy, insufficient, or over-trained local data, and when testing data is released early. Local evaluation and withholding the testing dataset address these cases.

  • Overfitting can arise from noisy or insufficient local data, over-training, or premature release of the testing dataset.
  • The central aggregator can evaluate local models using the testing dataset to address noise, insufficient data, and over-training.
  • Testing data should remain unreleased during model updates when premature disclosure could cause overfitting.
  • Local evaluation functions reduce computation and help avoid insufficient gas costs during model assessment.

V. PERFORMANCE EVALUATION AND ANALYSIS

The evaluation simulates the proposed framework on MNIST and CIFAR-10 with AlexNet, varying participant composition, poisoning intensity, privacy parameters, and defense settings. Results indicate poisoning resistance and a privacy–accuracy tradeoff.

  • Experiment Setting: Experiments use TensorFlow to train AlexNet collaboratively on MNIST and CIFAR-10 tasks.
  • Experiment Setting: Participant sets contain 10, 100, 200, or 300 devices, including 20% malicious, 20% unreliable, and 60% well-behaved participants.
  • Experiment Setting: The Ethereum deployment uses D-SGD with mini-batch size m = 128, learning rate α = 0.0001, dropout rate 0.5, and ε = 8.
  • Poisoning Defense: 65.2% accuracy is achieved on CIFAR-10 with 20% malicious participants at λ = 20% and EMD = 1.5.
  • Poisoning Defense: Under the strongest poisoning setting, the proposed framework’s accuracy remains unchanged as attack intensity increases, unlike aggregation without defenses.
  • Inference Defense: 99.21% and 93.72% are the Non-DP accuracies on MNIST and CIFAR-10, respectively, while stronger local privacy protection sacrifices some accuracy.
  • Inference Defense: When δ = e−6 and P = 300, the proposed accuracy is close to the scheme without defensive measures.

VI. CONCLUSIONS AND FUTURE DIRECTIONS

The framework combines blockchain smart contracts with local differential privacy to secure federated learning in 5G networks. The authors identify fairness, computational efficiency, and communication overhead as open issues.

  • Smart contracts automatically validate model updates against poisoning attacks through a blockchain-based marketplace.
  • Gaussian noise added through local differential privacy protects against membership inference attacks.
  • The framework was validated on two datasets for secure federated learning in 5G networks.
  • Open questions include unfair device usage, deep-learning computational demands, and communication overhead that reduces FL accuracy.
Loading 2005.05752v1…