Source-linked AI summary
Differentially Private Secure Multi-Party Computation for Federated Learning in Financial Applications
David Byrd, Antigoni Polychroniadou
TL;DR
Federated learning can keep financial data local, but model parameters may still reveal private information, while differential-privacy noise can reduce accuracy. This paper combines differential privacy with secure multi-party computation, demonstrates the protocol on credit-card fraud data, and evaluates accuracy and simulated runtime across privacy and participation settings. It concludes that the combination supports collaborative fraud-model training with added protection against data recovery, subject to collusion and scalability boundaries.
Problem
Federated model parameters can leak private client information, while differential privacy protects it at an accuracy cost; financial firms need collaboration without sharing sensitive transactions.
Method
The paper combines federated learning, differential privacy, and secure multi-party computation, using local logistic regression and encrypted noisy model weights.
Results
The protocol was demonstrated on a real-world credit-card fraud dataset and evaluated for accuracy and expected running time across client counts, 𝜖 values, and MPC neighborhood sizes.
Takeaways & Limitations
Multiple parties can collaboratively learn a useful fraud-detection model without sharing local data or transactions, with protection intended to make private-data recovery difficult or impossible against adversarial participants.
Abstract
from arXiv · showhide
Federated Learning enables a population of clients, working with a trusted server, to collaboratively learn a shared machine learning model while keeping each client's data within its own local systems. This reduces the risk of exposing sensitive data, but it is still possible to reverse engineer information about a client's private data set from communicated model parameters. Most federated learning systems therefore use differential privacy to introduce noise to the parameters. This adds uncertainty to any attempt to reveal private client data, but also reduces the accuracy of the shared model, limiting the useful scale of privacy-preserving noise. A system can further reduce the coordinating server's ability to recover private client information, without additional accuracy loss, by also including secure multiparty computation. An approach combining both techniques is especially relevant to financial firms as it allows new possibilities for collaborative learning without exposing sensitive client data. This could produce more accurate models for important tasks like optimal trade execution, credit origination, or fraud detection. The key contributions of this paper are: We present a privacy-preserving federated learning protocol to a non-specialist audience, demonstrate it using logistic regression on a real-world credit card fraud data set, and evaluate it using an open-source simulation platform which we have adapted for the development of federated learning systems.
1 INTRODUCTION
Federated learning keeps raw data local while sharing model information, but communicated weights can still leak private data. This paper combines differential privacy with secure multi-party computation to support collaborative financial learning without sharing local transactions.
- Motivation: Centralizing financial data can violate permissions, conflict with owners’ wishes, and increase the consequences of breaches.The paper cites a breach exposing sensitive information from 31 million Android app users as an example of centralized-data risk.
- Federated Learning: Federated learning lets users train local models and share model weights with a server that returns an averaged shared model.This workflow enables collaboration without directly sharing the underlying local data.
- Privacy Challenge: Model weights can still reveal details about individual training data, creating a privacy problem even when raw data never leaves local devices.Differential privacy adds randomness to weights, but this introduces an accuracy trade-off.
- Secure Computation: Secure multi-party computation lets parties compute a shared function without revealing private inputs, while revealing only the final result.Applied to federated learning, encrypted weights allow the server to calculate a weighted average without seeing the original weights.
- Combined Approach: MPC alone can leak individual inputs when the final result and all but one participants’ inputs are known.The paper therefore adds differential privacy, so the output does not permit exact recovery even under extreme collusion.
- Financial Application: The paper targets regulated financial collaboration, demonstrating secure fraud detection while keeping client data in originating silos and sharing encrypted, differentially private models.Its contributions include an accessible protocol, an open-source development platform, and a demonstration on a severely imbalanced real-world fraud dataset.
2 BACKGROUND AND RELATED WORK
The paper introduces the security and learning components underlying its protocol: MPC protects private inputs, differential privacy bounds disclosure, and local logistic models are combined into a shared model. Privacy is controlled through noise calibrated to sensitivity and the privacy parameter.
- Secure Multi-Party Computation: Secure multi-party computation lets parties jointly evaluate a function while each party learns its designated output and nothing else.The protocol must also address adversarial behavior and collusion among participants.
- Security Model: The paper models adversaries as semi-honest: they follow the protocol but may infer private information from messages or collude with other parties.This is the security level considered in prior work for the same setting.
- Differential Privacy: Differential privacy makes neighboring datasets statistically indistinguishable, with smaller 𝜖 providing stronger privacy but worse accuracy.The privacy parameter must balance privacy and accuracy for the application.
- Laplacian Mechanism: The Laplacian mechanism adds symmetric zero-mean random noise, with scale determined by query sensitivity and the privacy parameter.For sensitivity Δ and privacy parameter 𝜖, the stated scale is λ = Δ/𝜖, and the mechanism preserves 𝜖-differential privacy.
- Local Logistic Regression: Logistic regression performs binary linear classification, with each party learning local weights from its feature instances and labels.Weights are optimized iteratively using gradient descent with learning rate 𝛼.
- Federated Logistic Regression: Federated learning combines locally trained estimators into a global model and adds differentially private noise to the cumulative model.In the protocol, each client adds noise to its trained local weights before aggregation.
- Noise Calibration: For 1-Lipschitz multi-party queries, global sensitivity is 2/(n·k·𝛼), where k is the smallest dataset size and 𝛼 is the regularization parameter.The sensitivity determines the Laplace noise scale used with privacy parameter 𝜖.
3 APPROACH
The approach combines federated learning with secure multi-party computation and differential privacy to train logistic-regression models while limiting exposure of client weights and data. Pairwise masking preserves the server’s weighted average, while differential privacy addresses collusion risks at an accuracy–privacy trade-off.
- Motivation: Financial firms may be unable or unwilling to share sensitive transaction and customer data, motivating privacy-preserving collaborative learning.The protocol targets collaborative fraud detection across firms that benefit from identifying fraudulent purchases together.
- Federated learning: Federated learning has clients train locally, send model updates, and receive a server-aggregated global model.In this paper, the local learning method is regularized logistic regression, with client updates consisting of its weights.
- Secure aggregation: Secure multi-party computation masks each client’s weights with pairwise shared randomness while allowing the server to compute the weighted average.For each client pair, one party adds shared random values and the other subtracts them, so masking cancels in the aggregate.
- Leakage and collusion: The protocol can hide client weights from the server, but the revealed shared model may still expose individual weights and local data.If n−1 clients collude, they can recover the exact weights of the remaining honest client from the encrypted computation.
- Differential privacy: Differential privacy adds independent noise to client weights so colluding clients recover noisy rather than exact weights, trading stronger privacy for learning accuracy.Lower epsilon means more noise and better protection against inference, but excessive noise interferes with accurate shared-model learning.
4 EXPERIMENTS
Experiments evaluate the privacy-preserving protocol on an extremely imbalanced real-world credit-card fraud dataset using simulated federated training. Results show a trade-off between differential-privacy strength, predictive performance, collusion resistance, and MPC scalability.
- Dataset and evaluation: The evaluation uses the Kaggle Credit Card Fraud dataset, where 492 of 284,807 records are labelled fraudulent, creating extreme class imbalance.The experiment excludes the original Time feature, uses Amount and transformed principal-component features, and adds an intercept.
- Dataset and evaluation: Each simulation uses a randomized 75%/25% train-test split, 1000 randomly selected local training rows per client per iteration, and a shared holdout test set.Experiments run 30 protocol iterations, with 250 local regression-training iterations per client in each protocol iteration.
- Protocol execution: Simulation timing measures Diffie-Hellman setup, encryption and privacy processing, local training, and service-agent communication to estimate protocol execution time.The experiments use a single thread while tracking separate agent times and preventing overlapping activities.
- Dataset and evaluation: MCC is used instead of simple accuracy because a classifier always predicting non-fraud would achieve a misleading 99.8% accuracy.MCC accounts for the true-negative prediction set and gives the naive classifier a value of zero.
- Protocol accuracy: Models trained with Protocol 1 at ε ≥ 5e−4 have similar mean accuracy to unsecured federated learning across all evaluated client population sizes.More participating clients permit lower ε values while retaining an accurate shared model.
- Colluding clients: MPC masking leaves the server without information about private weights, while colluding parties still face uncertainty about an honest client’s privacy noise.With 100 clients, the masking sum is at least eight orders of magnitude larger than the weight range; at ε = 5e−5, reported mean absolute values are W_0 = 0.62 and P_0 = 0.38.
- Peer exchange neighborhood: Full pairwise MPC exchanges scale as O(N^2), whereas smaller peer-exchange neighborhoods can speed protocol components at the expense of privacy or accuracy.Figures 4 and 5 compare peer groups of size N and log(N) using execution time and shared-model accuracy.
5 CONCLUSION
The paper presents a differentially private secure multi-party computation protocol for federated learning and demonstrates it on anonymized credit-card fraud data. Experiments use an agent-based discrete-event simulation to evaluate accuracy and expected running time across protocol settings.
- The protocol combines differential privacy and secure multi-party computation for federated learning without requiring prior security or distributed-learning expertise.
- Multiple parties collaboratively learn a useful fraud-detection model without sharing client data or transactions, while added protections hinder private-data recovery by adversarial participants.
- The full protocol is implemented on anonymized financial data and evaluated for accuracy and expected running time under varying party counts, privacy parameters, and MPC neighborhood sizes.