PaperlayerView exact revision on arXiv

Source-linked AI summary

Federated Dynamic GNN with Secure Aggregation

Meng Jiang, Taeho Jung, Ryan Karl, Tong Zhao

arXiv:2009.07351v1cs.CRcs.LG

TL;DR

Distributed surveillance needs dynamic object representations without centralizing private video data or exposing information through federated updates. Feddy combines dynamic GNN representation learning with self-supervised trajectory prediction, federated training, and secure aggregation. Experiments across four video scenes report effective and secure performance, while the framework’s added computation and communication costs remain a limitation.

  • Problem

    Distributed surveillance requires learning complex spatial and dynamic patterns across devices while avoiding centralized data collection and inference attacks on local datasets.

    Source: §1 · p. 2

  • Method

    Feddy combines dynamic GNNs, self-supervised future-position prediction, federated learning, and secure aggregation to learn object representations without exchanging training data.

    Source: §1 · p. 2

  • Results

    Experiments on four real-world video camera scenes demonstrate that Feddy achieves good effectiveness and security in an unsupervised distributed setting.

    Source: §1 · p. 2, §7 · p. 9

  • Takeaways & Limitations

    Feddy provides a distributed framework for learning object representations from multi-user graph sequences while keeping user data off the central server.

    Source: §7 · p. 9

    Increased computation and communication costs may negatively affect broader impacts, although cryptographic research may reduce this overhead over time.

    Source: Broader impacts · p. 9

Abstract

from arXiv · show

Given video data from multiple personal devices or street cameras, can we exploit the structural and dynamic information to learn dynamic representation of objects for applications such as distributed surveillance, without storing data at a central server that leads to a violation of user privacy? In this work, we introduce Federated Dynamic Graph Neural Network (Feddy), a distributed and secured framework to learn the object representations from multi-user graph sequences: i) It aggregates structural information from nearby objects in the current graph as well as dynamic information from those in the previous graph. It uses a self-supervised loss of predicting the trajectories of objects. ii) It is trained in a federated learning manner. The centrally located server sends the model to user devices. Local models on the respective user devices learn and periodically send their learning to the central server without ever exposing the user's data to server. iii) Studies showed that the aggregated parameters could be inspected though decrypted when broadcast to clients for model synchronizing, after the server performed a weighted average. We design an appropriate aggregation mechanism of secure aggregation primitives that can protect the security and privacy in federated learning with scalability. Experiments on four video camera datasets (in four different scenes) as well as simulation demonstrate that Feddy achieves great effectiveness and security.

1 Introduction

Feddy addresses annotation-free representation learning, decentralized training, and privacy risks in distributed surveillance by combining dynamic GNNs, federated learning, and secure aggregation.

  • Feddy is an unsupervised, distributed, secured framework for learning object representations from graph sequences across users or devices.Source: §1 · p. 2
  • Dynamic GNN training preserves spatial and temporal patterns by predicting future object positions from graph-sequence features without human annotation.The model uses an MSE loss, with a default prediction horizon of 5 seconds or 150 graphs at 30 fps.Source: §1 · p. 2
  • Federated learning trains one shared dynamic GNN across devices while exchanging model updates rather than training data.Source: §1 · p. 2
  • Secure aggregation limits the parameter server to aggregated model information, preventing inference attacks on individual training data.Source: §1 · p. 2
  • Experiments on four Stanford Drone Dataset scenes show that Feddy delivers effective and secure unsupervised distributed learning.Source: §1 · p. 2

2 Dynamic GNN for Learning Surveillance Video

The dynamic GNN represents each video frame as an attributed graph and combines spatial relationships within the current graph with node dynamics across preceding graphs.

  • Each video frame becomes an attributed graph whose nodes are moving objects, with positions, visual features, and weighted spatial links.Source: §2 · pp. 2–3
  • A self-supervised MSE objective trains final embeddings to predict future object positions, so CNN-detected boxes remove the need for human annotations.Source: Figure 1 · p. 3, §2 · p. 4
  • The model learns node embeddings that preserve spatial information and temporal dynamics for tracking, forecasting, and malicious behavior detection.Source: §2 · p. 3
  • Each layer combines current-node embeddings with neighboring-node information from the previous graph and the node’s previous embedding.Source: §2 · pp. 3–4
  • The aggregation function may use mean pooling, max pooling, or an LSTM, while link importance can prioritize shorter spatial distances.Source: §2 · p. 4

3 Federated Learning for Training Distributed Dynamic GNNs

Feddy extends dynamic GNN training across distributed video sequences by optimizing a weighted average of local losses through federated learning.

  • Each client generates embeddings and computes its local loss on its own graph sequence before sending updated weights or gradients for aggregation.Source: §3 · p. 4
  • Federated optimization trains a shared dynamic GNN from multiple video sequences without uploading private local data to the central server.Source: §3 · p. 4
  • The global objective is the weighted average of client losses, with client weights typically proportional to local dataset sizes.Source: §3 · pp. 4–5
  • FedAvg updates global parameters using the aggregated client gradients and can reduce communication rounds by increasing local epochs.Source: §3 · p. 5

4 Privacy-preserving FL with Improved Secure Aggregation

The section develops secure aggregation for federated learning by combining privacy-preserving masking approaches while addressing their communication and trusted-dealer limitations. The resulting scheme supports repeated masking without extra key sharing and bounds fixed-point aggregation error.

  • Secure aggregation is motivated by inference attacks in regular federated learning, where exposed individual updates can reveal information about training datasets.Source: §4 · p. 5
  • Secure aggregation lets users compute an aggregate such as a sum without disclosing individual inputs to others.Source: §4 · p. 5

Secure aggregation with pair-wise one-time pads

  • Pair-wise one-time pads provide perfect secrecy but require frequent pad sharing because the pads cannot be reused, increasing communication overhead.Source: §4 · p. 5

Secure aggregation of time-series data

  • Time-series secure aggregation uses a trusted key dealer to distribute pads summing to zero, then masks each input with a time-dependent hash and RSA-based modulus.Source: §4 · p. 5

Our improved secure aggregation

  • The improved scheme combines both approaches so users can reuse shared pads without extra sharing or a trusted key dealer.Source: §4 · p. 6

Mapping between real numbers and integers

  • Fixed-point encoding converts real values to integers for aggregation, with approximation error bounded above by 2^-(e+1)|U|.Source: §4 · p. 6

5 Experiments

Experiments evaluate Feddy’s effectiveness, runtime, and secure-aggregation overhead across four video scenes and simulated federated settings. Feddy outperforms the raw-feature MLP, while secure aggregation introduces measurable but bounded computational and communication costs.

5.1 Experimental settings

  • The experiments use four Stanford Drone Dataset scenes, with videos converted into graph sequences and divided into training, validation, and testing periods.Each 30-fps video spans over 10,000 frames; the first minute is used for training and the last three minutes for testing.Source: §5.1 · p. 6, Table 1 · p. 6

5.2 Results on effectiveness

  • Feddy’s RMSE for predicting horizontal and vertical positions is lower than the raw-feature MLP across all tested user counts and embedding dimensions.Performance improves as embedding dimension increases, and differences across 1, 2, 5, and 10 users become very small when d ≥128.Source: §5.2 · p. 7

5.3 Results on efficiency

  • Federated optimization adds runtime over non-federated learning, but runtime remains comparable as the number of users increases.Feddy’s time cost is 1.5× to 3× that of non-federated GNN.Source: §5.3 · pp. 7–8

5.4 Results on secure aggregation

  • Secure-aggregation masking costs grow linearly with users and quadratically with model dimension, while parameter-server aggregation remains negligible.Masking and aggregation are parallelized, and aggregation occurs once every 10 epochs.Source: §5.4 · p. 8
  • Secure aggregation introduces non-negligible communication overhead as the tradeoff for provable data security.The masking cost is comparable to total GNN-training costs during the epochs between aggregations.Source: §5.4 · p. 8

6 Related Work

Related work covers dynamic GNNs for evolving graph structure, federated learning for decentralized optimization, and secure aggregation for privacy-preserving computation. The paper positions its focus at the intersection of spatial-temporal video graphs, distributed learning, and sequential-data security.

Dynamic/evolutionary GNN

  • Dynamic GNN research models evolving structures and temporal patterns such as attribute dynamics, interaction trajectories, and continuous-time processes.Feddy focuses on spatial and dynamic information in video graph sequences.Source: §6 · p. 8

Federated machine learning

  • Federated machine learning distributes optimization across decentralized clients and supports training deep networks on user-held data.Prior work includes federated optimization and scalable system designs [6] [21] [22] [30] [44] [48].Source: §6 · p. 8

Secure aggregation on time-series data

  • Existing secure-aggregation methods address federated or privacy-preserving learning, but time-series aggregation may require additional semantic analysis of dynamic user groups.The paper identifies sequential data as a setting where prior methods cannot be directly applied.Source: §6 · p. 9

7 Conclusions

The paper concludes that Feddy learns object representations from multi-user graph sequences by combining spatial and dynamic information with self-supervised trajectory prediction. Federated learning and scalable secure aggregation support distributed training without exposing user data, and four real-world datasets demonstrate effectiveness and security.

7 Conclusions

  • Feddy combines spatial and dynamic information with self-supervised trajectory prediction to learn object representations from multi-user graph sequences.The framework is distributed and secure.Source: §7 · p. 9
  • Local devices train and periodically send model updates without exposing user data to the central server.Secure aggregation protects federated-learning privacy and security with scalability.Source: §7 · p. 9
  • Experiments on four real-world video-camera datasets demonstrate Feddy’s effectiveness and security.Source: §7 · p. 9

Broader impacts

Feddy addresses privacy and security concerns in federated learning for sensitive surveillance video through a secure aggregation scheme. The paper notes that cryptographic overhead may constrain broader impacts.

  • Feddy presents provably secure federated learning for GNNs on sensitive surveillance video, targeting stronger data security, cybersecurity, and individual privacy.Source: Broader impacts · p. 9
  • Increased computation and communication costs may negatively affect the framework’s broader impacts, although cryptographic acceleration research may reduce this overhead over time.Source: Broader impacts · p. 9

A Correctness of Feddy

The correctness analysis shows that Feddy can recover aggregated gradients from fixed-point encoded values under its group and modulus assumptions. The chosen parameters also avoid modulus overflow in practical neural-network settings.

  • Feddy correctly maps the integer sum of encoded values to the real-valued aggregated gradients, with fixed-point error bounded by 2^-(e+1)|U|.Source: A Correctness of Feddy · pp. 12–13
  • The correctness theorem assumes masked values sum to zero modulo N and uses a multiplicative cyclic group of order N.Source: A Correctness of Feddy · p. 12
  • The hash function can be constructed from RSA-related system parameters generated by a crypto server or secure multi-party computation; this paper adopts the crypto-server approach.Source: A Correctness of Feddy · p. 12
  • With a 2048-bit modulus and values below 100 bits, at least 2^1948 values can be added without modulus overflow.Source: A Correctness of Feddy · p. 13

B Security of Feddy

Feddy’s security analysis defines privacy against adaptive semi-honest adversaries while preserving the aggregator’s access to the analytical result. The model assumes open communication channels and excludes reliability assessment for small user deviations.

B.1 Adversary Model

  • Feddy’s security model treats users and the aggregator as adaptive semi-honest adversaries that follow the protocol but may infer private values from observations.Source: §B.1 · p. 13
  • The framework gives the analytical result only to the aggregator, while keeping user data secret except for information deducible from the aggregate.Source: §B.1 · p. 13
  • The analysis assumes communication channels are open to eavesdropping and leaves the reliability of small user-reported deviations outside the paper’s scope.Source: §B.1 · p. 13

B.2 Security Definition

Feddy formalizes secure aggregation as a collection of setup, key-generation, masking, and aggregation algorithms. Its privacy definition uses simulation, while masking security is framed through an IND-CPA data-publishing game.

B.2 Security Definition

  • Feddy consists of four polynomial-time algorithms: Setup, KeyGen, Mask, and Aggregate.Source: §B.2 · p. 13
  • Setup generates public system parameters, and distributed KeyGen gives each user a secret key.Source: §B.2 · p. 13
  • Mask converts each user’s private value into a published masked value, while the aggregator computes the sum of encoded private values.Source: §B.2 · p. 13
  • The masking security experiment is a data-publishing game, and IND-CPA security requires every polynomial-time adversary’s advantage to be negligible in the security parameter.Source: §B.2 · pp. 13–14, Figure 4 · p. 14
  • Feddy privacy is defined by simulation against semi-honest adversaries, requiring that adversaries gain no more information than their inputs, the output, and what those reveal.Source: §B.2 · p. 14

B.3 Security Proof

Feddy's security proof establishes privacy through a sequence of simulation games under DDH and DCR hardness assumptions. The proof concludes that real and simulated executions are indistinguishable, so the protocol securely computes the supported aggregation functions.

Cryptographic assumptions

  • The masking scheme is IND-CPA secure under the random-oracle model when DDH and DCR are assumed hard.The adversary's advantage is bounded using the DDH advantage and the query count qc.Source: §B.3 · p. 15

Game-based proof

  • The game-based proof transitions from the original masking game to a failure-event game, yielding adv2 = adv1 e(qc+1).Game 2 uses a biased coin for each time window, and the transition is analyzed through the probability that no failure event occurs.Source: §B.3 · p. 15
  • A random masking change in Game 3 is bounded by the DDH advantage, while randomization prevents distinguishing except with negligible cryptographic advantage.The proof combines the game transitions to obtain advA · qc e(qc + 1)^2 ≤ advDDH before concluding the theorem.Source: §B.3 · pp. 15–16

Security theorem

  • Feddy privately computes the supported aggregation functions against semi-honest adversaries under the stated protocol and masking assumptions.The theorem assumes |C| = O(log κ), correct algorithm instantiation, and random masking.Source: §B.3 · p. 16

Simulation security

  • The proof shows that a probabilistic polynomial-time simulator can generate an indistinguishable adversarial view from the corrupted inputs and aggregate output.This establishes simulation security without exposing additional information from honest participants.Source: §B.3 · p. 16

Related papers

Loading 2009.07351v1…