PaperlayerView exact revision on arXiv

Source-linked AI summary

SecureDrive-FL: Joint Differential Privacy and Gradient-Aware Selective Homomorphic Encryption for Federated Driver Monitoring

Baran Can Gül, Hanuma Siddhartha Tunuguntla, Anjana Arvind Naik, Abhishek Vijay Potekar, Nasser Jazdi, Michael Weyrich

arXiv:2608.27108v1cs.CRcs.LG

TL;DR

FL gradient updates remain vulnerable to MitM interception and poisoning despite distributed training and DP-based protections. SecureDrive-FL couples DP-SGD with GASHE, deriving selective HE encryption from DP sensitivity calibration. It preserves poisoning resistance, prevents the reported MitM accuracy collapse, and adds approximately 8–10% runtime overhead.

  • Problem

    FL gradient updates remain exposed to MitM interception and model poisoning, while uniform HE encryption is costly and prior DP–HE hybrids configure protections independently.

  • Method

    SecureDrive-FL couples DP-SGD with GASHE, using DP-SGD sensitivity bounds to select gradient components for CKKS encryption during communication.

  • Results

    73.6% vs. 74.0% accuracy and 3.9% vs. 3.9% Attack Success Rate under poisoning accompany 78.2% vs. 10.4% accuracy under MitM, with approximately 8–10% added runtime overhead.

  • Takeaways & Limitations

    The joint pipeline aligns training-time privacy calibration with communication-time confidentiality while retaining poisoning performance comparable to DP-SGD alone.

Abstract

from arXiv · show

Federated Learning (FL) enables privacy-aware distributed training, yet gradient updates remain exploitable: Man-in-the-Middle (MitM) interception exposes updates in transit, while model poisoning corrupts global convergence. We first introduce GASHE (Gradient-Aware Selective Homomorphic Encryption), a novel selective encryption strategy that dynamically identifies and encrypts only the gradient components exceeding a DP-calibrated sensitivity threshold, rather than encrypting all parameters uniformly as in static layer-based or full-parameter CKKS schemes. Building on GASHE, we introduce SecureDrive-FL, a federated driver monitoring framework that couples DP-SGD with GASHE to create the first closed-loop DP+HE privacy pipeline: DP-SGD calibration parameters directly derive the GASHE encryption mask, unifying training-time privacy and communication-time confidentiality. Evaluated on a ten-class distracted driver classification task under non-IID federated splits, SecureDrive-FL matches DP-SGD alone's poisoning resistance (73.6% vs. 74.0% accuracy, 3.9% Attack Success Rate for both) while additionally withstanding MitM interception, where DP-SGD alone collapses to near-random accuracy (78.2% vs. 10.4%), all under only approx. 8--10% additional runtime overhead relative to DP-SGD alone---under DP-SGD noise injection with per-round privacy parameter epsilon_0=4.

I. INTRODUCTION

SecureDrive-FL addresses FL privacy and security gaps by coupling DP-SGD with GASHE, a DP-calibrated selective encryption strategy. The framework is evaluated against poisoning and MitM interception in distracted-driver recognition.

  • Motivation: FL transmits gradient updates without formal privacy guarantees, exposing distributed driver data to inference and interception threats.The automotive threat surface includes shared cloud infrastructure operated by OEMs, insurers, and third-party providers.
  • Motivation: FHE protects encrypted aggregation but full-parameter encryption is costly, while DP-SGD provides quantifiable privacy through calibrated Gaussian noise but leaves transmitted updates exposed.These mechanisms address different stages of the FL pipeline and involve practical privacy-utility or resource trade-offs.
  • Contributions: GASHE dynamically encrypts the k gradient components exceeding the DP-calibrated threshold τ_i instead of encrypting the full parameter vector.The strategy is architecture-agnostic and uses CKKS encryption while retaining formal privacy semantics.
  • Contributions: SecureDrive-FL derives HE encryption decisions from DP-SGD sensitivity bounds, coupling training-time noise calibration with communication-time confidentiality.The reported configuration uses per-round ε_0=4, σ=1.2112, C=1.2, and δ=10^-5, with IND-CPA confidentiality at communication time.
  • Evaluation: 73.6% vs. 74.0% accuracy and 3.9% vs. 3.9% Attack Success Rate show poisoning performance comparable to DP-SGD alone.Under MitM interception, SecureDrive-FL maintains 78.2% accuracy while DP-SGD alone falls to 10.4%.
  • Evaluation: The framework is evaluated on a ten-class distracted driver recognition task using non-IID, user-partitioned FL and lightweight MobileNetV2-Tiny.The reported evaluation achieves approximately 74% accuracy under active attack with per-round ε_0=4.

A. Privacy Threats in Federated Learning

FL updates can leak sensitive information through inference and interception attacks. DP and HE offer complementary protections, but existing approaches face residual exposure, overhead, or static encryption choices.

  • Threats: Model inversion, membership inference, and GAN-based leakage attacks exploit shared FL updates or model outputs to recover sensitive information.These threats target input attributes, training-set membership, or collaborative-learning information.
  • Differential Privacy: DP bounds individual-record contributions through clipping and calibrated Gaussian noise, but DP-SGD does not protect gradients transmitted over the network.Gradient inversion can still partially succeed when the signal-to-noise ratio is favorable, particularly with small batch sizes.
  • Homomorphic Encryption: HE enables computation on encrypted data for secure aggregation, with methods such as quantization, batching, secret sharing, and CKKS-based encryption reducing or extending its use.These approaches support secure aggregation across FL and IoT settings.
  • Homomorphic Encryption: Uniform full-parameter encryption imposes prohibitive computational and memory overhead on resource-constrained edge devices.Partial or layer-based schemes reduce cost but use static, architecture-dependent rules rather than adapting to individual gradient sensitivity.
  • Hybrid Defenses: Prior hybrid DP–HE approaches configure noise-based privacy and encrypted aggregation independently without directing encryption toward the most sensitive gradients.This motivates a coupled approach that integrates client-side DP-SGD with GASHE for secure and efficient aggregation.

A. System Overview

SecureDrive-FL applies DP-SGD during local training and GASHE during gradient communication, while retaining raw sensor data on participating vehicles. The system targets honest-but-curious servers and evaluates active poisoning and network-layer adversaries.

  • Pipeline: DP-SGD provides formal statistical indistinguishability during local training, while GASHE prevents raw gradient exposure during communication.The mechanisms operate at different stages of the FL pipeline.
  • Threat Model: The aggregator is modeled as honest-but-curious, following FL while attempting to infer private information from updates, intermediate aggregation states, and logs.The setting reflects automotive deployments using third-party cloud providers or shared OEM infrastructure.
  • Threat Model: Active adversaries are also evaluated through malicious model-poisoning updates and network-layer interception.These threats extend the system model beyond passive server inference.
  • Client Processing: Each vehicle passively collects sensor data D_i, and raw data remains on the client rather than being transmitted.Local preprocessing extracts relevant features before the data are partitioned into training and validation subsets.

D. Local Training with DP-SGD

SecureDrive-FL trains local models with DP-SGD, then derives a DP-informed threshold and mask to selectively protect sensitive update components during communication.

  • DP-SGD mechanism: DP-SGD clips per-sample gradients to L2-norm C and adds calibrated Gaussian noise during each mini-batch update.The injected noise has standard deviation σC.
  • Sensitivity threshold: The client computes Δwi = Wi − Wglobal after local training and derives a DP-informed sensitivity threshold from the DP-SGD calibration.The threshold uses ε0, δ, and C.
  • Sensitivity threshold: Gradients exceeding τi dominate the DP noise floor and are treated as the most privacy-sensitive components when transmitted in plaintext.In the configured system, τi coincides with the operational noise standard deviation σC.
  • Selective protection: A binary mask selects high-sensitivity components for encryption, while low-magnitude parameters remain plaintext alongside a compact bitmask.This creates the selective communication pattern used by GASHE.
  • Selective protection: Selective encryption reduces ciphertext size and FHE evaluation time in proportion to the sparsity of Mi.The strategy avoids encrypting the full parameter vector.
  • Privacy accounting: The stated privacy guarantee applies to DP-SGD over T local steps per round and N communication rounds, with cumulative accounting reported separately.For C=1.2, σ=1.2112, N=120, and δ=10^-5, εtotal≈48.94.

F. Homomorphic Aggregation

SecureDrive-FL aggregates encrypted high-sensitivity update components homomorphically while separately summing plaintext low-magnitude components, then reconstructs the full update.

  • Encrypted aggregation: The server aggregates encrypted client updates with CKKS additive homomorphic operations without decrypting individual updates.The aggregation supports server-side processing under insider-threat considerations.
  • Pipeline overview: DP-SGD protects local training privacy while GASHE selectively encrypts high-sensitivity gradients before transmission.The two mechanisms operate at different stages of the FL pipeline.
  • Update recovery: Clients recover the global model update by decrypting the aggregated ciphertext stream.The protocol broadcasts the aggregate ciphertext for client-side recovery.
  • Plaintext aggregation: The server also aggregates low-magnitude plaintext components as Pagg = Σi(1 − Mi)⊙Δwi.These components are transmitted without encryption.
  • Update recovery: The two-stream design lets all d gradient dimensions contribute while only k high-sensitivity components incur FHE overhead.The encrypted and plaintext streams together reconstruct the full aggregate gradient.

IV. SYSTEM AND ADVERSARIAL EVALUATION SETUP

The evaluation uses a ten-class distracted-driver recognition task built from two datasets and partitioned by driver to model non-IID federated data.

  • Dataset: The study combines the State Farm and AUC distracted-driver datasets into over 50,000 labelled images across ten distraction categories.The categories include safe driving, texting, phone calls, radio operation, drinking, reaching behind, grooming, and talking to a passenger.
  • Federated split: Each client receives images from 3–5 unique drivers, inducing non-IID heterogeneity representative of driver diversity.Images are resized, normalised, and locally augmented with flips and brightness jitter.

B. Model and Federated Learning Configuration

The system uses a lightweight MobileNetV2-Tiny model in a 120-round federated configuration, with DP-SGD, CKKS, and repeated-seed evaluation settings specified for reproducibility.

  • Model and FL configuration: MobileNetV2-Tiny provides the convolutional backbone, with approximately 2.2M parameters and six clients participating per round.Training runs for 120 FL rounds with local batch size 32.
  • DP configuration: DP-enabled runs use C=1.2, σ=1.2112, δ=10^-5, and ε0=4, yielding εtotal≈48.94 over 120 rounds.Privacy accounting uses Rényi DP composition.
  • HE configuration: CKKS is implemented with TenSEAL using polynomial modulus degree 8192, scaling factor 240, and coefficient modulus chain [60, 40, 40, 60].The experiments run on a single host with six logical FL clients.
  • Evaluation protocol: Each configuration is independently executed with three random seeds to assess statistical reliability.The reported tables use the mean across the three runs.
  • Protocol: The federated protocol initializes a global model, selects clients each round, encrypts client updates, homomorphically aggregates them, and broadcasts the aggregate.Clients decrypt the aggregate and update the global model.
  • Client update: Client updates clip gradients, add Gaussian noise, compute τi, build Mi, and encrypt only Mi⊙Δwi.This sequence operationalizes the DP-GASHE client update.
  • Evaluation protocol: Across seeds, variance remains low: accuracy σ < 1.5 percentage points, ASR σ < 2.5 percentage points, and runtime σ < 2%.The authors report these differences as systematic rather than stochastic.

D. Adversarial Threats and Defence Mechanisms

The threat model includes passive and active MitM adversaries targeting transmitted gradients, while GASHE protects sensitive components and detects manipulated aggregates through consistency and loss monitoring.

  • MitM interception: Passive MitM adversaries store intercepted gradient traffic, while active adversaries replace client updates with manipulated gradients.
  • MitM interception: The adversary may recover private training data through gradient inversion or by exploiting plaintext low-magnitude streams.
  • GASHE defence: GASHE encrypts the high-sensitivity stream and leaves only low-magnitude, DP-noise-dominated parameters in plaintext.
  • Active-attack detection: The server detects active manipulation by checking ciphertext decryption consistency and monitoring global updates with a 3-sigma validation-loss rule.
  • Model poisoning: Model-poisoning clients submit crafted updates embedding a backdoor trigger targeting a specified class.

2) Model Poisoning:

The poisoning evaluation models compromised clients that submit targeted backdoor updates, while SecureDrive-FL combines bounded updates with encrypted sensitive coordinates and compares against multiple defenses.

  • Attack setup: The poisoning update uses a target-class gradient direction, with α controlling poisoning intensity and a norm bound γ constraining multi-round consistency attacks.
  • Defence mechanism: GASHE encrypts coordinates exceeding τi, bounds each client contribution’s aggregate sensitivity, and is combined with FedAvg norm clipping.
  • Baselines: SecureDrive-FL is compared with DP-SGD alone, Full-CKKS, GASHE-only, robust aggregation, encrypted aggregation, and proximal-regularised FL baselines.
  • Evaluation: Table I reports final accuracy, Attack Success Rate, and Macro-F1 under clean, MitM, and poisoning conditions.

A. Federated Utility

SecureDrive-FL preserves utility across clean and adversarial settings: selective encryption adds little clean-setting cost, maintains MitM resilience, and retains DP-SGD-level poisoning performance.

  • Clean utility: 82.2% clean accuracy for SecureDrive-FL exceeds DP-SGD alone’s 80.0% by 2.2 percentage points.
  • Baseline comparison: TrimmedMean and Krum reach 91.4% and 90.2% poisoning accuracy with 0.0% and 1.9% ASR, respectively, despite lacking DP guarantees.
  • MitM robustness: Under MitM, SecureDrive-FL achieves 78.2% accuracy, while DP-SGD alone collapses to 10.4% final accuracy.
  • Poisoning robustness: Under poisoning, SecureDrive-FL reaches 73.6% accuracy versus 74.0% for DP-SGD alone, with identical 3.9% Attack Success Rate.

C. Computational Overhead

SecureDrive-FL adds only ≈8–10% runtime overhead over DP-SGD alone while combining privacy and communication protection, although GASHE-only and full-parameter CKKS remain costly.

  • Baseline comparisons: 1,130.4–1,538.6 s makes GASHE-only ≈3.0–4.1× slower than clean FedAvg, with 1.88–2.09 GB peak RSS.The selective encryption strategy therefore does not eliminate substantial standalone encryption overhead in this implementation.
  • Baseline comparisons: 8,388.7–8,847.7 s makes DP-SGD alone ≈22.2–23.4× the FedAvg baseline, with 0.77–0.86 GB peak RSS.SecureDrive-FL adds a modest incremental cost on top of this more expensive privacy baseline.
  • SecureDrive-FL cost: 9,218.0–9,637.6 s runtime represents only ≈8–10% overhead relative to DP-SGD alone, with 1.76–1.94 GB peak RSS.SecureDrive-FL measures ≈24.3–25.5× the FedAvg baseline over 120 rounds.
  • Security–efficiency trade-off: SecureDrive-FL’s marginal GASHE cost is low relative to DP-SGD alone while eliminating the MitM attack surface.The framework is presented as providing formal DP, IND-CPA communication security, and poisoning resistance comparable to DP-SGD alone.
  • Baseline comparisons: 1,227.3–1,481.3 s and 1.80–1.88 GB peak RSS place full-parameter CKKS near, and sometimes above, GASHE-only in measured cost.Threshold computation, mask construction, and stream splitting offset savings from encrypting fewer components.
Loading 2608.27108v1…