Source-linked AI summary
Privacy-preserving Federated Learning based on Multi-key Homomorphic Encryption
Jing Ma, Si-Ahmed Naas, Stephan Sigg, Xixiang Lyu
TL;DR
Federated learning limits data sharing but does not eliminate leakage from model updates, while existing cryptographic approaches can be difficult to deploy on constrained IoT devices. The paper introduces xMK-CKKS, which encrypts updates with an aggregated public key and uses collaborative decryption. The scheme preserves accuracy relative to traditional federated learning and reduces computational cost relative to Paillier-based federated learning, but does not withstand malicious participants that sabotage training.
Problem
Model updates shared by federated learning can leak sensitive information, while cryptographic privacy methods may be unsuitable for constrained mobile IoT devices.
Method
xMK-CKKS encrypts model updates with an aggregated public key and decrypts aggregated results using collaboration among participating devices.
Results
93.37% accuracy with xMK-CKKS versus 93.80% with federated learning at L = 20, with comparable accuracy also reported at L = 40.
Takeaways & Limitations
The xMK-CKKS-based federated learning scheme provides confidential model updates and is suitable for federated learning scenarios involving IoT devices.
Takeaways & Limitations
The scheme may not withstand malicious participants that send incorrect or adversarial updates to sabotage or bias the learning process.
Abstract
from arXiv · showhide
With the advance of machine learning and the internet of things (IoT), security and privacy have become key concerns in mobile services and networks. Transferring data to a central unit violates privacy as well as protection of sensitive data while increasing bandwidth demands.Federated learning mitigates this need to transfer local data by sharing model updates only. However, data leakage still remains an issue. In this paper, we propose xMK-CKKS, a multi-key homomorphic encryption protocol to design a novel privacy-preserving federated learning scheme. In this scheme, model updates are encrypted via an aggregated public key before sharing with a server for aggregation. For decryption, collaboration between all participating devices is required. This scheme prevents privacy leakage from publicly shared information in federated learning, and is robust to collusion between $k<N-1$ participating devices and the server. Our experimental evaluation demonstrates that the scheme preserves model accuracy against traditional federated learning as well as secure federated learning with homomorphic encryption (MK-CKKS, Paillier) and reduces computational cost compared to Paillier based federated learning. The average energy consumption is 2.4 Watts, so that it is suited to IoT scenarios.
1 Introduction
Federated learning avoids sharing local data, but model updates can still leak sensitive information. The paper proposes xMK-CKKS-based federated learning to encrypt updates, require collaborative decryption, and reduce computational load while maintaining accuracy.
- Motivation and privacy problem: IoT devices generate distributed data that can include private medical records and personal activities.
- Motivation and privacy problem: Model updates shared in federated learning may leak sensitive information or enable recovery of original training data.
- Motivation and privacy problem: Traditional homomorphic federated learning uses shared secret keys, allowing participants to decrypt one another’s encrypted data and enabling collusion attacks.
- Proposed approach: xMK-CKKS encrypts model updates with an aggregated public key and requires decryption shares from all participants for aggregated ciphertexts.
- Proposed approach: The proposed federated learning scheme protects model-update confidentiality and is robust against collusion between k < N −1 participating devices and the server.
- Evaluation: The scheme is evaluated on Jetson Nano IoT devices against federated learning schemes using homomorphic encryption, with reduced computational load and reasonable energy consumption while maintaining accuracy.
2 Related work
Prior work addresses federated-learning privacy with secure aggregation, differential privacy, and homomorphic encryption, but these approaches involve security, performance, communication, or deployment constraints. Multi-key homomorphic encryption improves key separation, while existing schemes can remain computationally or communicationally expensive.
- Homomorphic encryption: Traditional homomorphic encryption lets parties use the same key, whereas multi-key homomorphic encryption permits different encryption keys and requires all participants for decryption.
- Homomorphic encryption: Early multi-key fully homomorphic encryption schemes faced high decryption complexity, high communication load, or ciphertext sizes that increase exponentially with participant count.
- Federated learning and privacy: Federated learning reduces communication through locally trained updates and iterative model averaging, but shared updates can leak sensitive information.
- Cryptographic privacy methods: Secure aggregation hides individual updates from the global sum, but some protocols require reliable channels, honest devices, pairwise communication range, or a trusted third party.
- Cryptographic privacy methods: Differential privacy protects individual data by adding noise to gradients, at the cost of severely reduced model performance in one federated-learning implementation.
- Homomorphic encryption: Homomorphic-encryption approaches have also been applied to encrypted inference and privacy-preserving federated learning using additive schemes such as Paillier.
3 Preliminaries
Federated learning trains models from decentralized data by sharing local updates, while homomorphic encryption enables operations on encrypted updates. Multi-key schemes use distinct participant keys and require joint decryption of aggregated ciphertexts.
- Federated learning: Federated learning keeps data on decentralized devices while sending locally computed model updates to a server for aggregation.FedAvg repeatedly averages participating devices’ model parameters until convergence.
- Homomorphic encryption: Homomorphic encryption permits computation on encrypted model updates without first decrypting them.A scheme is fully homomorphic when its efficient evaluation supports both addition and multiplication.
- Multi-key homomorphic encryption: Multi-key homomorphic encryption assigns different encryption keys to participants and requires combining their corresponding secret keys to decrypt aggregated ciphertexts.This supports collaborative decryption when no participant holds multiple secret keys.
- MK-CKKS: MK-CKKS is an RLWE-based multi-key variant of CKKS supporting approximate fixed-point arithmetic.The paper introduces only its additive homomorphism because federated learning does not use homomorphic multiplication.
- MK-CKKS: MK-CKKS encrypts each plaintext into a two-component ciphertext using a participant public key, randomness, and error terms.Encoding maps complex values into ring polynomials before encryption, and decoding reverses this after decryption.
- MK-CKKS: The sum of ciphertexts from multiple devices can be jointly decrypted by computing with the concatenated secret keys, yielding an approximate sum of plaintexts.The summed ciphertext combines first components while retaining each participant’s second component for joint decryption.
4 Multi-key homomorphic encryption for Federated learning
The paper adapts MK-CKKS into xMK-CKKS for federated learning by encrypting updates under an aggregated public key and requiring device-generated decryption shares. The resulting scheme protects individual updates under an honest-but-curious threat model and supports iterative FedAvg aggregation.
- Motivation: MK-CKKS cannot directly protect federated learning updates because the server could decrypt individual model updates and infer private data.The paper modifies MK-CKKS so the server can decrypt only the aggregation of shared encrypted updates.
- Threat model: The threat model assumes honest-but-curious servers and devices, including collusion between the server and k < N −1 devices.Participants follow the protocol but may try to infer other devices’ private information from shared intermediate results.
- xMK-CKKS: xMK-CKKS aggregates all devices’ public keys for encryption and requires each device to send a decryption share for the aggregated ciphertext.The share combines the ciphertext sum with the device’s secret key and an added error term.
- xMK-CKKS: The decryption-share design prevents a share from independently decrypting another ciphertext and mitigates privacy leakage during decryption.The paper states that xMK-CKKS is robust against collusion between k < N −1 honest-but-curious devices and the server.
- Federated learning protocol: The federated learning protocol applies FedAvg with all participating devices contributing in each aggregation round.Devices train locally, encrypt their resulting weights, and the server homomorphically aggregates them before merging decryption shares.
- Federated learning protocol: Each round consists of local training, encryption under the aggregated public key, server-side ciphertext addition, collaborative decryption, and model updating.The process repeats until model convergence; the decryption noise distribution φ is assumed to have larger variance than ψ.
5 Security analysis
The scheme protects individual model updates from an honest-but-curious server and devices, including collusion between fewer than N−1 devices and the server. It uses collaborative decryption and RLWE-based masking so shared ciphertexts and decryption shares do not reveal private weights.
- Theorem 1 states that an honest-but-curious server cannot infer private information about device data.
- RLWE-based error masking makes ciphertext components and decryption shares computationally indistinguishable from random elements, hiding model updates and secret keys from the server.
- Collaborative decryption allows the server to obtain only the sum of gradients, not individual device weights.
- An honest-but-curious device cannot infer private information from another device’s uploaded information.
- Collusion between k < N −1 devices and the server does not reveal model updates from other devices.
- Even when other devices possess their own secret keys, they cannot jointly decrypt a victim’s individual ciphertext encrypted under the victim’s key.
- With two uncompromised parties, subtracting colluding parties’ plaintexts leaves a sum of two uncompromised parties’ plaintexts rather than an individual update.
6 Evaluation
The evaluation compares xMK-CKKS with traditional federated learning, MK-CKKS, and Paillier in an elderly-fall detection deployment using 10 Jetson Nano devices. xMK-CKKS preserves accuracy, reduces computational time versus Paillier, communicates compact ciphertexts, and consumes about 2.4 watts.
- 10 Jetson Nano devices store distributed accelerometer data for an elderly-fall detection experiment using the UP-FALL dataset.
- The study evaluates accuracy, communication cost, energy consumption, and computational cost against traditional federated learning, MK-CKKS, and Paillier.
- Accuracy: 93.37% accuracy at L = 20 and 93.53% at L = 40 were achieved by xMK-CKKS, versus 93.80% and 93.81% for federated learning without encryption.
- Communication cost: 87KB ciphertexts for xMK-CKKS are smaller than the 296KB ciphertexts for Paillier-based federated learning.
- Communication cost: Increasing local training epochs reduces the aggregation rounds required for convergence to 10 or 5, thereby reducing communication cost.
- Energy consumption: 2.4 watts average energy consumption is reported for xMK-CKKS, equal to 24% of the Jetson Nano’s 10-watt maximum.
- Computational cost: xMK-CKKS has computational cost approximately similar to MK-CKKS and significantly lower than Paillier across the evaluated phases.
7 Conclusion and future work
The paper concludes that xMK-CKKS provides privacy-preserving federated learning through aggregated public keys and collaborative decryption. The evaluation supports its IoT applicability, while the authors identify malicious participants and non-iid data as boundaries for future work.
- xMK-CKKS improves MK-CKKS by defining an aggregated public key and decryption share for secure model-update encryption and decryption.
- The scheme guarantees model-update confidentiality and robustness against collusion between k < N −1 participating devices and the server.
- Experiments on 10 Jetson Nano devices evaluate accuracy, communication cost, energy consumption, and computational cost in an elderly-care setting.
- The scheme may not withstand malicious participants that send incorrect, random, or deliberately biased updates to sabotage learning.
- Further work is needed because Byzantine defenses assume iid training data, which is difficult to guarantee in actual IoT scenarios.