PaperlayerView exact revision on arXiv

Source-linked AI summary

From Distributed Machine Learning To Federated Learning: In The View Of Data Privacy And Security

Sheng Shen, Tianqing Zhu, Di Wu, Wei Wang, Wanlei Zhou

arXiv:2010.09258v1cs.DC

TL;DR

Federated learning keeps training data on client devices, but inference and malicious updates still threaten privacy and model integrity. This survey examines privacy and security mechanisms and attack models, finding improvements over DML alongside unresolved vulnerabilities.

  • Problem

    Federated learning reduces direct exposure of raw data, yet client-side inference and malicious updates can threaten privacy and global-model performance.

    Source: §2.2.2 · p. 5, §4 · p. 11

  • Method

    The paper surveys federated learning’s privacy and security, including its data flows, vulnerabilities, attacks, and future research directions.

    Source: §6 · p. 17

  • Results

    Federated learning offers significant improvements over DML in security and efficiency, but remains vulnerable to inference and malicious-client effects.

    Source: §2.3 · pp. 6–7

  • Takeaways & Limitations

    The authors identify preventing inference-related data leaks and improving tolerance to anomalous updates while preserving utility and accuracy as future research directions.

    Source: §6 · p. 17

    Federated learning remains vulnerable to membership-inference and backdoor attacks, and its large participant count makes adversaries difficult to detect.

    Source: §6 · p. 17

Abstract

from arXiv · show

Federated learning is an improved version of distributed machine learning that further offloads operations which would usually be performed by a central server. The server becomes more like an assistant coordinating clients to work together rather than micro-managing the workforce as in traditional DML. One of the greatest advantages of federated learning is the additional privacy and security guarantees it affords. Federated learning architecture relies on smart devices, such as smartphones and IoT sensors, that collect and process their own data, so sensitive information never has to leave the client device. Rather, clients train a sub-model locally and send an encrypted update to the central server for aggregation into the global model. These strong privacy guarantees make federated learning an attractive choice in a world where data breaches and information theft are common and serious threats. This survey outlines the landscape and latest developments in data privacy and security for federated learning. We identify the different mechanisms used to provide privacy and security, such as differential privacy, secure multi-party computation and secure aggregation. We also survey the current attack models, identifying the areas of vulnerability and the strategies adversaries use to penetrate federated systems. The survey concludes with a discussion on the open challenges and potential directions of future work in this increasingly popular learning paradigm.

1 INTRODUCTION

Federated learning coordinates clients that keep training data on their devices and send model updates to a server for aggregation. This survey reviews its privacy and security mechanisms, remaining attack risks, and research directions.

1 INTRODUCTION

  • Federated learning can support collaborative model training in settings such as governments, hospitals, and financial institutions.The passage describes the resulting model as less sensitive to other clients’ raw data.Source: §1 · p. 2
  • Unlike traditional DML, federated learning makes the server a coordinator, while DML may allow clients to request other clients’ training data.In DML, the server and data manager partition training data and model tasks for clients.Source: §1 · p. 2
  • Clients train with data kept on their devices and send model updates for server aggregation, rather than transferring raw training data.The server coordinates client participation and updates the global model from returned parameters or gradients.Source: §1 · pp. 1–2
  • Differential privacy and local differential privacy protect data and updates at the numeric level; secure aggregation uses MPC, secret sharing, or homomorphic encryption.These mechanisms address privacy during training and security during update transfer and aggregation.Source: §1 · p. 2
  • Federated learning remains vulnerable to inference, backdoor, and model-poisoning attacks, and the survey focuses on privacy techniques, adversarial models, challenges, and future directions.The survey notes that prior reviews mostly emphasized systems and applications, with few treating privacy and security in detail.Source: §1 · p. 2

2 FROM DISTRIBUTED MACHINE LEARNING TO FEDERATED LEARNING

Distributed machine learning partitions data and models across scheduled clients, while federated learning keeps training data on client devices and coordinates shared model training. The comparison presents reduced communication and server storage as advantages, while noting that federated learning retains privacy and security risks.

2.1 Distributed Machine Learning

  • DML partitions data and models among scheduled clients, with the parameter server coordinating subtasks and aggregating the resulting sub-models.Balancing learning and communication costs matters because storage, bandwidth, and time can constrain large-scale data work.Source: §2.1 · p. 3, §2.1.1 · p. 3

2.1.1 The Structure and Data Flows of Distributed Machine Learning

  • The DML server or a third-party data manager accesses the whole dataset to create partitions, while only sub-model updates return to the server.The passage describes this data flow as one-way for the partitioned data.Source: §2.1.1 · p. 3

2.1.2 Privacy and Security Problems and Adversaries in DML

  • DML’s communication demands create attack opportunities, and a successful breach can expose partitions at a client or the entire database or model at central infrastructure.The survey distinguishes spectators, who observe, from participants, who can affect learning; higher-level devices are more attractive targets.Source: §2.1.2 · p. 3

2.2 Federated Learning

  • Federated learning is described as a form of DML designed to address some privacy and security problems in the classic architecture.The comparison retains a central server but shifts data collection and processing toward clients.Source: §2.2 · p. 3, §2.2.1 · p. 4

2.2.1 Basic Structures and Data Flow

  • Federated clients train on local data and send encrypted parameter updates for aggregation; temporary aggregators process encrypted updates without knowing the true data.Master aggregators manage epochs and combine temporary aggregators’ results before the server updates the model.Source: §2.2.1 · p. 5

2.2.2 Privacy And Security Problems And Adversaries In Federated Learning

  • Federated learning still exposes client data to inference attacks and leaves the master model vulnerable at aggregators or the central server.The survey distinguishes spectator and participant adversaries and identifies model parameters or sensitive data as potential targets.Source: §2.2.2 · pp. 5–6

2.3 From DML to Federated Learning

  • Federated learning is presented as improving security and efficiency over DML through client-held data, shared parallel tasks, and less communication, while still exchanging model updates.The section also says this reduces direct privacy leaks during communication and the need for client-to-client transfers.Source: §2.3 · p. 6
  • Federated learning reduces server storage by processing data on clients, but its framework alone cannot guarantee privacy or security, so additional mechanisms are needed.The survey also notes that malicious clients can have a substantial effect and that updates can support model-parameter reconstruction.Source: §2.3 · pp. 6–7

3 PRIVACY PRESERVATION AND SECURITY IN FEDERATED LEARNING

The survey reviews differential privacy for protecting client data and updates, alongside cryptographic mechanisms for securing aggregation. These protections have trade-offs and do not ensure that client training results are valid.

3.1.1 Differential Privacy

  • DP makes query outputs on neighboring datasets statistically similar by adding noise; local DP perturbs individual data and avoids relying on a trustworthy third party.The privacy budget controls protection: a smaller ε means greater privacy.Source: §3.1.1 · p. 7

3.1.2 Differential Privacy in Federated Learning

  • Global DP adds noise server-side but makes sensitivity difficult to set; client-side schemes perturb gradients or updates, trading privacy against model utility.Client-side approaches include clipping and noising gradients or client updates; one proposed client-level bound based on a non-randomized median caused a privacy violation.Source: §3.1.2 · p. 8
  • The original client-update clipping bound used a non-randomized median, which caused a privacy violation.The bound was set to the median of client updates.Source: §3.1.2 · p. 8

3.2.2 Secure Aggregation in Federated Learning

  • Local DP can impair utility through greater noise, and available privacy and security mechanisms protect updates but cannot validate clients’ contributions to the global model.The survey identifies balancing privacy with acceptable performance as a future research direction; communication security mechanisms are also needed because DP protects data, not communication.Source: §3.1.2 · pp. 8–9, §3.2.2 · p. 11

3.2 Security in Federated learning

  • Secure aggregation encrypts client updates before transmission so parties, including the server, access ciphertext while aggregating through secret sharing, MPC, or homomorphic encryption.The survey distinguishes data-level privacy protections from mechanisms securing transmission and aggregation.Source: §3.2 · p. 9, §3.2.2 · p. 10

3.2.1 Preliminaries of Security Mechanisms

  • Secret sharing distributes secrets as shares, with reconstruction governed by access structures; MPC computes functions over private inputs, while homomorphic encryption enables operations on ciphertext at higher computational cost.General-access secret sharing can require share size exponential in the number of parties; fully homomorphic encryption supports both addition and multiplication.Source: §3.2.1 · p. 9

3.2.2 Secure Aggregation in Federated Learning

  • Bonawitz’s protocol masks client inputs so the server learns their sum; secret-shared keys help handle disconnects, but key exchange and secret sharing add communication cost.A second mask protects a disconnected client’s inputs if that client reconnects after its private key is recovered.Source: §3.2.2 · p. 10
  • NIKE-based aggregation reduces communication for key sharing and dropout recovery, while PrivFL combines shared local-gradient computation with global-gradient reconstruction for regression protocols robust to disconnections.NIKE-based recovery asks neighbors for shares; PrivFL uses additive homomorphic encryption and secure aggregation primitives.Source: §3.2.2 · pp. 10–11

4 ATTACKS AND FEDERATED LEARNING

Federated learning prevents direct leaks of sensitive information to a malicious data server, but remains vulnerable to client-side inference and server-side model degradation. The section surveys adversarial goals, membership inference, poisoning methods, and their limitations.

4 ATTACKS AND FEDERATED LEARNING

  • Client-side adversaries can infer training-set data, while malicious updates can substantially affect the global model because client updates are averaged without monitoring.Federated learning prevents direct leaks of sensitive information to a malicious data server, but these attack paths remain.Source: §4 · p. 11

4.1 Adversarial Goals and Capabilities

  • Inference attacks seek sensitive information; poisoning attacks target global accuracy broadly or alter behavior on selected tasks while preserving other performance.The adversary-capability summary is identified as Table 3.Source: §4.1 · p. 11, Table 3 · p. 12

4.2.1 Preliminary of Membership Inference Attack

  • Membership inference tests whether a record was in training, exploiting differences between a model’s behavior on training and test data.Black-box studies report that training-data distribution and model generalizability contribute to privacy leaks, and overfit models are more susceptible.Source: §4.2.1 · p. 12, §4.2.2 · p. 12

4.2.2 Membership Inference Attacks against Federated Learning

  • Membership-inference methods use shadow models, loss thresholds, or white-box features; reported findings include moderate vulnerability under differential privacy and greater leakage from the network’s last layer.Stronger privacy protection is associated with decreasing utility; threshold methods can perform close to or better than classic shadow training.Source: §4.2.2 · pp. 12–13

4.3.1 Basic Poisoning Attacks

  • Poisoning injects crafted training points to alter model behavior; objectives include preventing convergence or creating a backdoor that preserves general test performance.Federated learning makes poisoning possible because malicious clients can hide among participants, servers cannot verify update authenticity, and secure aggregation prevents auditing individual updates.Source: §4.3.1 · pp. 13–14

4.3.2 Poisoning Attacks Against Federated Learning

  • Constrain-and-scale, explicit boosting, and GAN-based attacks illustrate different poisoning strategies, while Sybil attacks reached 96.2% success with only 2 Sybils.The Sybil study also reports that enough Sybils can overpower honest clients and that existing defenses relying on training-data observations could not thwart the attack.Source: §4.3.2 · p. 14
  • Poisoning defenses and attack assumptions leave open challenges: repeated client selection is uncommon, and many attacks assume similarly sized client datasets.The survey says existing defenses relying on training-data observation are ineffective in federated settings; unequal client data volumes and classes remain a challenge for attackers.Source: §4.3.2 · pp. 14–15

5 APPLICATIONS OF FEDERATED LEARNING

The survey describes federated learning applications that keep data processing on client devices, including edge systems, blockchain combinations, and recommendation services. These applications include privacy-oriented designs as well as stated assumptions and computational trade-offs.

5 APPLICATIONS OF FEDERATED LEARNING

  • Offloading computation to client devices gives federated learning stronger privacy guarantees and reduced communication costs across large-scale applications.The survey identifies IoT, blockchain, and recommendation systems as application areas.Source: §5 · p. 15

5.1 Federated learning in IoT Environment and Edge Computing

  • In edge anomaly detection, clients train locally and upload updates without sharing data, but described frameworks assume honest edge nodes and gateways.Edge caching and offloading methods optimize decisions with federated learning; deep reinforcement learning can cause delays across many heterogeneous devices.Source: §5.1 · p. 15

5.2 Federated Learning in Blockchain

  • Federated learning and blockchain both distribute processing and contributions among participants; surveyed systems combine them for privacy-oriented sharing and aggregation.Examples include permissioned-blockchain data sharing and replacing a central aggregator with selected miners who average client updates.Source: §5.2 · p. 16

5.3 Federated Learning in Recommendation System

  • Recommendation systems use federated learning for keyboard suggestions and preference-based recommendations without collecting sensitive client data centrally.The survey also describes emoji diversification and federated collaborative filtering that aggregates client gradients.Source: §5.3 · pp. 16–17

6 CONCLUSION

The conclusion presents federated learning as a privacy- and security-oriented distributed learning approach, while identifying protection costs and attack vulnerabilities. It points to reducing secure-aggregation complexity and improving resistance to inference and anomalous updates as future work.

6 CONCLUSION

  • Federated learning keeps training data on client devices and sends partial model updates for server aggregation and subsequent training rounds.The survey characterizes the framework as suitable for large participant populations common to online services.Source: §6 · p. 17
  • Global and local differential privacy protect data and updates, while secure aggregation protects the global model; secure aggregation is computationally expensive.Global differential privacy is vulnerable to an adversarial aggregator; local differential privacy can protect updates before transmission but is sensitive to noise that can reduce utility.Source: §6 · p. 17
  • Membership inference and backdoor attacks remain vulnerabilities, motivating work on preventing training-time leaks and tolerating anomalous updates while maintaining utility and accuracy.The survey identifies detecting adversaries as difficult in systems with many participants who contribute equally to the global model.Source: §6 · p. 17
Loading 2010.09258v1…