PaperlayerView exact revision on arXiv

Source-linked AI summary

Aegis: Generative Gradient Masking for Privacy-Preserving Medical Federated Learning

Chaoyu Zhang, Shanghao Shi, Heng Jin, Ning Wang, Y. Thomas Hou, Wenjing Lou

arXiv:2609.38339v1cs.CRcs.AI

TL;DR

Medical FL updates can reveal patient images through scalable model inversion attacks, even when secure aggregation is used. Aegis adds masking gradients computed on locally synthesized, task-relevant data to real client updates, exploiting attack batch-size limits. It suppresses three state-of-the-art attacks while maintaining utility across the reported benchmarks, with deployment sizing affected by adversarial changes to first-layer width.

  • Problem

    Scalable, closed-form model inversion attacks can reconstruct private medical images from shared updates, including under secure aggregation, while existing defenses trade utility for privacy or fail to eliminate leakage.

    Source: §1 · pp. 1–2

  • Method

    Aegis adds a large-batch masking gradient computed on locally synthesized, task-relevant data to each client's real update, pushing effective batch size beyond leakage capacity.

    Source: §1 · p. 2, §4.1 · p. 5, §4.2 · p. 6

  • Results

    Robbing-the-Fed RR is 9.38–11.63% across medical modalities; across MNIST, CIFAR-10, and three MedMNIST modalities, Aegis suppresses three MIAs while matching or exceeding state-of-the-art defense utility.

    Source: §1 · p. 2, §5.3 · p. 10

  • Takeaways & Limitations

    Aegis is presented as a protocol-compatible privacy building block that avoids perturbing patient samples and uses task-relevant synthetic data to induce gradient collisions.

    Source: §6 · p. 10

    If the server increases first-FC width k, Aegis requires a correspondingly larger masking batch, making batch sizing under unknown or adaptive k a deployment consideration.

    Source: §5.3 · p. 10

Abstract

from arXiv · show

Federated learning (FL) has become a foundational paradigm for multi-institutional medical AI, allowing hospitals and research centers to jointly train diagnostic models without exchanging patient records. This privacy promise, however, is increasingly contested: a malicious or honest-but-curious server can launch model inversion attacks (MIAs) that reconstruct private patient images directly from shared model updates, and recent scalable, closed-form attacks penetrate even secure aggregation at clinically realistic batch sizes. Existing defenses face an unsatisfactory dilemma. Gradient-perturbation methods such as differential privacy and pruning trade away the diagnostic accuracy on which clinical reliability depends, while cryptographic protocols add system complexity yet still leave updates exposed to these scalable attacks. We propose Aegis, a principled client-side defense that breaks this dilemma without perturbing patient data or modifying the FL protocol. Our key insight is that the success of every known MIA is fundamentally bounded by the local batch size relative to the model's leakage capacity; once this limit is exceeded, distinct samples collide and reconstructions collapse into indistinguishable mixtures. Aegis turns this universal bottleneck into a defense: each client superimposes onto its real update a masking gradient computed on locally synthesized, task-relevant data, deliberately pushing the effective batch beyond the attack's recovery capacity. We complement the design with theoretical convergence guarantees under standard convex assumptions and evaluate Aegis on MNIST, CIFAR-10, and three MedMNIST modalities (chest X-ray, abdominal CT, colon pathology). Aegis neutralizes three state-of-the-art MIAs while preserving model utility and incurring only modest overhead, offering a practical privacy primitive for medical FL.

1 Introduction

Medical federated learning keeps patient records local, but shared updates can still reveal sensitive images through model inversion attacks. Aegis uses synthetic-data masking gradients to exploit attack batch-size limits, aiming to protect privacy without perturbing patient samples or changing the FL protocol.

1 Introduction

  • Scalable linear-leakage attacks can reconstruct patient images even under secure aggregation, while existing defenses either reduce clinical model utility or leave leakage exposed.The paper therefore seeks a defense effective against these attacks that preserves utility and requires no protocol modification.Source: §1 · p. 2
  • Known MIA reconstruction is bounded by local batch size relative to model capacity; linear-leakage attacks fail when batch size exceeds first-FC-layer neuron count.Inputs then collide in leakage bins, producing mixed, indistinguishable reconstructions.Source: §1 · p. 2
  • Aegis adds a masking gradient computed on a large, locally synthesized defense dataset to each client's real update before sharing.It does not perturb real patient samples, discard informative gradients, or alter the FL protocol.Source: §1 · p. 2
  • Aegis provides convergence analysis under standard convex assumptions and is evaluated on MNIST, CIFAR-10, and three MedMNIST modalities.The analysis does not claim a non-convex deep-learning guarantee; experiments report suppression of Robbing-the-Fed, LOKI, and Scale-MIA while matching or exceeding the utility of state-of-the-art defenses.Source: §1 · p. 2

2 Preliminaries and Related Work

The section outlines how federated updates remain vulnerable to inversion, contrasts optimization-based and linear-leakage attacks, and reviews defenses and the role of task-relevant generated data. Its central technical point is that linear leakage has a batch-size limit that Aegis can target.

2 Preliminaries and Related Work

  • Federated learning keeps client datasets local but transmitted updates can still expose those datasets to model inversion attacks.The section frames hospitals and research centers as clients holding private data while contributing to a shared model.Source: §2 · p. 2

2.1 Model Inversion Attacks in Federated Learning

  • Optimization-based attacks match dummy to target gradients, whereas linear-leakage attacks recover inputs in closed form and can operate under realistic FL conditions.For linear leakage, recovery is exact for an isolated activation, but shared activations produce mixtures; attacks succeed only while batch size B does not exceed first-layer neuron count k.Source: §2.1 · p. 3

2.2 Defenses against MIAs

  • Perturbation defenses alter learning gradients and can harm utility, while secure aggregation adds overhead and has been defeated by attacks that reconstruct from aggregates.Prior generated-data defenses targeted centralized attacks, and the authors identify no prior FL defense exploiting linear leakage's structural bottleneck with auxiliary generated data.Source: §2.2 · p. 4

2.3 Generative Models for Image Synthesis

  • Aegis can use conditional generators of different architectures, provided synthesized samples are task-relevant enough to avoid harming utility while inducing leakage-bin collisions.The passage names GANs, VAEs, and diffusion-based models as possible sources of auxiliary data.Source: §2.3 · p. 4

3 Threat Model

The threat model considers medical clients that retain their private datasets while a server coordinates training and may mount strong model inversion attacks. It also reports that ordinary local hyperparameter changes do not meaningfully reduce reconstruction quality within utility-preserving ranges.

3 Threat Model

  • The server knows and controls the global model and may plant crafted leakage layers, attack at any round, and use auxiliary data to calibrate leakage bins.It is modeled as an active adversary capable of attacking updates under standard FL protocols, including secure aggregation.Source: §3 · p. 4
  • Medical clients keep patient datasets local and seek updates whose diagnostic accuracy remains close to the no-defense baseline.Clients cannot reliably determine whether the broadcast model is benign or adversarially crafted, or which MIA variant is in use.Source: §3 · p. 4
  • Changing batch size, learning rate, and local epochs within utility-preserving ranges does not meaningfully reduce Robbing-the-Fed reconstruction quality.The section uses this result to motivate an explicit defense rather than reliance on local training hyperparameters.Source: §3 · p. 4
  • Aegis's overview has each client synthesize in-distribution defense data, compute a large-batch masking gradient, and add it to the real update once per local epoch.The resulting effective batch exceeds first-FC leakage capacity, so collisions yield blended rather than identifiable reconstructions.Source: Figure 2 · p. 5

4 System Design

Aegis addresses an active-server threat by pushing shared updates beyond known attack leakage capacity through client-side synthetic-gradient masking. Its design uses auxiliary data while keeping real patient data and the FL protocol unchanged.

4 System Design

  • An active server may craft the broadcast model, and clients cannot reliably distinguish it from a benign model.Source: §4 · p. 5

4.1 Defense Principle and Intuition

  • Aegis drives the effective batch above k, the first crafted FC layer’s leakage-bin capacity, so reconstructions collapse into mixtures rather than identifiable patient samples.Private and synthetic samples activate the same leakage bins.Source: §4.1 · p. 5

4.2 Detailed Design

  • Clients generate an auxiliary defense dataset and choose its size so B + Mi > k; out-of-distribution samples may miss leakage bins or bias training.The dataset is constructed on the client using local labels and filtered against an in-distribution budget.Source: §4.2 · p. 6
  • Each epoch combines ordinary training on local data with a masking-gradient computation, then applies a combined step.The masking gradient is computed once per epoch, not once per round.Source: §4.2 · p. 6
  • Closed-form recovery returns blended images rather than identifiable patient samples, while the shared update retains the standard learning signal and leaves the FL protocol unchanged.Aegis does not perturb private data or discard gradient components.Source: §4.2 · p. 6

5 Experiments

Experiments compare Aegis with established defenses on standard and medical FL benchmarks, assessing utility, reconstruction privacy, and training overhead. Aegis tracks the no-defense utility baseline and suppresses reconstruction across attacks and medical modalities.

5.1 Experimental Setup

  • The evaluation asks whether Aegis suppresses linear-leakage attacks while preserving utility without prohibitive overhead, using MNIST, CIFAR-10, and three MedMNIST modalities.The study uses Robbing-the-Fed, LOKI, and Scale-MIA, with RR, PSNR, and SSIM for reconstruction and test accuracy across FL rounds for utility.Source: §5 · p. 6, §5.1 · pp. 6–7

5.2 Round-to-Accuracy under Defense

  • On MNIST and CIFAR-10, Aegis tracks the no-defense baseline most closely and achieves the highest final test accuracy among defenses.Figure 3 compares round-to-accuracy trajectories with Aegis defense batch size 2048.Source: §5.2 · p. 8, Figure 3 · p. 8
  • Aegis adds one large-batch forward-backward pass per local epoch; micro-batch gradient accumulation preserves the masking gradient but can increase wall-clock time roughly with Mi/b.The overhead can matter for resource-constrained clients; Table 1 reports wall-clock training times for 100 MNIST and 150 CIFAR-10 rounds.Source: §5.2 · p. 8, Table 1 · p. 8

5.3 Effectiveness against Linear-Leakage MIAs

  • Across Robbing-the-Fed, LOKI, and Scale-MIA on CIFAR-10, RR, PSNR, and SSIM all decrease as Aegis’s defense batch size grows.The reported reconstructions become progressively indistinguishable from noise as the effective batch exceeds linear-leakage capacity.Source: §5.3 · pp. 8–9, Figure 4 · p. 9
  • If a server increases first-FC width k, Aegis requires a larger defense batch Mi; unknown or adaptive k is a deployment consideration.The discussed adaptive-adversary possibilities also include demixing bins using public generator knowledge or attacks outside linear leakage.Source: §5.3 · p. 10
  • 9.38–11.63% RR across three MedMNIST modalities under Aegis, versus 78–89% without defense; aggregate PSNR and SSIM also collapse relative to no defense, DP, and GC.The table covers ChestMNIST, OrganAMNIST, and PathMNIST Robbing-the-Fed reconstructions.Source: Table 2 · p. 9, §5.3 · p. 10

6 Conclusion

Aegis uses locally synthesized, task-relevant data to add a large-batch masking gradient to each real client update, targeting linear-leakage model inversion attacks. The paper reports utility-preserving privacy results across five datasets and competitive overhead, while its stability analysis is limited to standard convex assumptions.

6 Conclusion

  • Aegis superimposes a large-batch masking gradient from locally synthesized task-relevant data onto the real update once per local epoch, forcing closed-form reconstructions into indistinguishable mixtures.The auxiliary samples must be sufficiently task-relevant to induce gradient collisions without harming utility.Source: §6 · p. 10
  • The reported evaluation on MNIST, CIFAR-10, and three MedMNIST modalities suppresses three state-of-the-art MIAs while preserving utility and incurring competitive overhead.The stability analysis uses standard convex assumptions and is not a non-convex guarantee.Source: §6 · p. 10

A Aegis Notation and Implementation Details

  • The client-side procedure leaves server aggregation unchanged, including when FedAvg or FedSGD uses secure aggregation.Aegis updates pass through the underlying secure-aggregation mask as standard updates, making its privacy benefit additive to that protocol.Source: A Aegis Notation and Implementation… · p. 15, §A.2 · p. 16

A.2 Implementation Notes

  • Caching the generated defense dataset amortizes its construction, while masking adds one pass over that dataset per local epoch.With E local epochs, this means E extra forward-backward passes per communication round.Source: §A.2 · p. 15
  • Gradient accumulation lets clients process a logical masking batch in smaller micro-batches without changing its mean gradient or collision argument, though it changes wall-clock time.The required defense batch is Mi = 2048, which may exceed accelerator memory.Source: §A.2 · pp. 15–16
  • Aegis depends on auxiliary samples being sufficiently task-relevant; out-of-distribution samples may fail to induce collisions or hurt utility.The paper uses a latent diffusion model but allows other generators when the in-distribution budget can be satisfied.Source: §A.2 · p. 16

B Additional Experimental Details

The appendix specifies the federated data, models, defense-generation pipeline, attack protocol, and evaluation metrics used in the experiments. It also states the compute environment and the scope of the active-server linear-leakage evaluation.

B Additional Experimental Details

  • The evaluation targets the active-server linear-leakage threat model and reports timing and training experiments on an Intel Core i9-11900K workstation with one NVIDIA GeForce RTX 3080 GPU.Reported results average multiple independent runs with different random seeds, including initialization and client-participation randomness.Source: B Additional Experimental Details · p. 16
  • Experiments simulate 100 non-overlapping clients with at most five classes each, sampling 10% per FedAvg round; local training uses Adam, three epochs, and batch size 64.The reported runs use learning rate 10^-3; gradient clipping is used only when required by a baseline implementation.Source: B Additional Experimental Details · p. 16
  • MNIST and CIFAR-10 use a shared CNN with three convolutional layers and a 512-unit fully connected layer; the same backbone is adapted to three MedMNIST datasets.For medical datasets, input channels and output width match each dataset’s channels and label cardinality.Source: B Additional Experimental Details · p. 16
  • Defense images use Stable Diffusion 2.0 with class-aligned prompts and an in-distribution filter; the default Aegis batch is Mi = 2048.One accepted defense candidate takes roughly five seconds to generate on the reported workstation.Source: B Additional Experimental Details · p. 16
  • Robbing-the-Fed, LOKI, and Scale-MIA use the utility schedule; reconstructions are evaluated after the first FL round unless a figure specifies another sweep.Metrics are PSNR, SSIM, and RR, with RR counting images above 18 dB PSNR; parenthetical table scores average successful reconstructions only.Source: B Additional Experimental Details · pp. 16–17

C Robbing-the-Fed under Varying Local Training Hyperparameters

Utility-preserving changes to local batch size, learning rate, and local epochs do not materially reduce Robbing-the-Fed reconstruction quality. This motivates a defense that directly targets the leakage-capacity bottleneck.

C Robbing-the-Fed under Varying Local Training Hyperparameters

D Additional Experiment: Multi-baseline Comparisons on CIFAR-10

On CIFAR-10, Aegis lowers Robbing-the-Fed’s reconstruction rate relative to no defense, with remaining reconstructions visually blended. Several other defenses reduce aggregate metrics, but successful reconstructions can retain high fidelity.

D Additional Experiment: Multi-baseline Comparisons on CIFAR-10

E.1 Medical Task Accuracy

Under the 100-client non-IID FedAvg setting, Aegis with M = 2048 keeps medical test accuracy within 0.3 percentage points of no defense. In the masking-batch sweep, increasing M reduces reconstruction rate while accuracy stays within 0.4 percentage points.

E.1 Medical Task Accuracy

  • The medical accuracy comparison uses the same 100-client non-IID FedAvg setting as Appendix B.Source: §E.1 · p. 18
  • At M = 2048, Aegis medical test accuracy differs from no defense by at most 0.3 percentage points across three datasets.The evaluation uses the same 100-client non-IID FedAvg setting; the Eloul et al. baseline uses MSE loss with same-label batching.Source: §E.1 · p. 18, Table A.4 · p. 19

E.2 Privacy–Utility Trade-off

  • As M increases, reconstruction rate falls while accuracy stays within 0.4 percentage points of no defense.The sweep compares Aegis and the Eloul et al. baseline against Robbing-the-Fed with B = 64, E = 3, and k = 1024.Source: Table A.5 · p. 19, §E.2 · p. 19

F.1 Generator Ablation

Across the evaluated generators, non-IID partitions, and classifier backbones, reconstruction metrics remain close in the reported Aegis and Robbing-the-Fed settings. Accuracy varies with partition and backbone, and the two-class constraint yields the lowest accuracy.

F.1 Generator Ablation

  • Accuracy and reconstruction metrics remain close across the evaluated generators under the same Aegis and Robbing-the-Fed configuration.The comparison uses M = 2048 and a shared locally visible label, preprocessing, and acceptance-filter setup; no test images are used for generation or adaptation.Source: §F.1 · p. 19, Table A.6 · p. 20

F.2 Non-IID Partitions

  • The two-class label-skew constraint yields the lowest accuracy, while reconstruction rates remain close across the tested non-IID partitions.The settings retain B = 64, M = 2048, k = 1024, and 10% client participation.Source: Table A.7 · p. 20, §F.2 · p. 20

F.3 Classifier Backbones

  • Classifier backbone changes affect accuracy, while reported reconstruction metrics remain close.The comparison uses the original non-IID partition, M = 2048, and the same crafted FC leakage front-end.Source: Table A.8 · p. 21, §F.3 · p. 21

G Convergence Analysis: Assumptions and Theorem

The analysis derives an O(1/T) convergence bound under standard convex assumptions and makes explicit how private–synthetic data discrepancy affects its constants. It also surveys gradient-based MIAs through the local-batch-size bottleneck relative to first-layer capacity.

G Convergence Analysis: Assumptions and Theorem

  • The analysis is a stability argument under standard convex assumptions, not a convergence guarantee for the non-convex neural networks used experimentally.The discrepancy H affects variance and uniform-norm constants; smaller H tightens the constants.Source: G Convergence Analysis: Assumptions… · p. 21

Assumptions

Gradient variance under mixed private and defense data

Convergence theorem

  • The bound retains the standard O(1/T) rate; positive private–synthetic data discrepancy enlarges constants B and C by a controlled amount.When the synthetic and private data are identically distributed, the bound recovers.Source: Convergence theorem · p. 22

H Survey of Gradient-based MIAs in Federated Learning

  • The MIA survey identifies local batch size relative to first-FC-layer capacity as a unifying bottleneck across attacks.The passage connects this observation to Aegis turning the bottleneck into a defense.Source: H Survey of Gradient-based MIAs in… · p. 22

I Extended Discussion and Limitations

This section discusses Aegis’s limitations and scope, including its threat assumptions, generator fit, resource needs, theory, and medical evaluation, and records the authors’ checklist framing of theory, reproducibility, potential misuse, and LLM use.

I Extended Discussion and Limitations

  • The threat model assumes clients follow the FL protocol while the server may send a reconstruction-crafted model; client-side poisoning and backdoors are orthogonal issues.The paper says these threats can be combined with Aegis using existing robust aggregation or poisoning defenses.Source: I Extended Discussion and Limitations · p. 22
  • Aegis needs a class- or text-conditional generator whose samples fall into the same leakage bins as real data, and better matching can reduce H and help preserve utility.Compatible sources include public pretrained, domain-adapted, or sanctioned in-domain generators; defense data stays local and is used only for masking-gradient computation.Source: I Extended Discussion and Limitations · p. 23
  • Aegis requires B + Mi to exceed leakage capacity k; the default Mi = 2048 exceeds the evaluated attacks’ k = 1024, and micro-batching trades memory for time.H is chosen with a small client-side validation split to balance synthetic diversity and utility.Source: I Extended Discussion and Limitations · p. 23
  • An adaptive server that widens its crafted FC layer may force Aegis to increase Mi, while removing synthetic contributions is underdetermined without client sample identities.The evaluation covers the known scalable linear-leakage family; unknown or adaptive leakage capacity remains a deployment consideration.Source: I Extended Discussion and Limitations · p. 23
  • The convergence guarantee applies under standard convex assumptions, while non-convex utility is evaluated empirically on three benchmark-resolution MedMNIST modalities.Extending to higher-resolution volumes or whole-slide pathology mainly changes generator and compute requirements, not the client-side masking protocol.Source: I Extended Discussion and Limitations · p. 23

NeurIPS Paper Checklist

  • The checklist says Appendix G states theory assumptions and gives a convergence theorem, while the setup and appendices specify experimental details and promise anonymized code and reproduction instructions.It also notes that the work introduces no new public dataset, benchmark, or model asset, and that its experiments use public benchmarks rather than human-subjects research.Source: NeurIPS Paper Checklist · pp. 25, 26, 29
  • The checklist identifies potential negative societal impacts as misuse risks from active servers and adaptive reconstruction attacks.It points to the threat model and Appendix I limitations as addressing those risks.Source: NeurIPS Paper Checklist · p. 28
  • The authors mark LLM usage as not applicable; defense-data synthesis instead uses conditional image generators, described in Sections 4 and 5.1.The paper says LLMs are not an original or non-standard component of the proposed defense or experiments.Source: NeurIPS Paper Checklist · p. 30
Loading 2609.38339v1…