PaperlayerView exact revision on arXiv

Source-linked AI summary

Combining Homomorphic Encryption and Differential Privacy in Federated Learning for Model Inspection and Availability

Ceren Yıldırım, Kamer Kaya, Sinan Yıldırım, Erkay Savaş

arXiv:2610.01650v1cs.CR

TL;DR

Federated learning keeps local data at clients, but model outputs and updates can still expose training information, while encrypted training complicates inspection. This paper combines HE-based training with DP-based inspection and model release, and reports improved utility and estimated privacy over DP-only training, alongside a privacy-estimation method based on MCMC and Bayesian analysis.

Abstract

from arXiv · show

The increasing prevalence of decentralized data has led to a growing interest in federated learning, which enables collaborative model training without clients sharing their sensitive local data. However, FL alone does not sufficiently protect sensitive training data and is generally coupled with privacy-preserving techniques, such as differential privacy and homomorphic encryption. Although powerful, these techniques address separate concerns via different mechanisms, so relying on just one might prove insufficient or impractical for addressing challenges associated with federated learning. In this work, we propose a privacy-preserving federated learning framework that combines homomorphic encryption-based training with differential privacy-based model inspection and release. We adopt a Markov chain Monte Carlo-based Bayesian privacy estimation method to estimate the privacy of our proposed framework. Our results show that this method improves both model utility and estimated privacy over the baseline method that relies solely on differential privacy for training. In our experiments with the FEMNIST dataset, by the end of training, our method reaches a test loss of $1.09$, compared to $2.37$ for the differential privacy-only approach, while providing stronger estimated privacy protection, with the estimated posterior mean of the privacy parameter $\epsilon$ of $4.32$, compared to $7.26$ for the differential privacy-only approach. We also show that intermittent model monitoring can preserve the encrypted training trajectory while, under our evaluated experimental setting, providing estimated privacy comparable to or stronger than the differential privacy-only approach.

I. INTRODUCTION

The introduction motivates combining homomorphic encryption and differential privacy to protect federated training while preserving utility and enabling inspection and release. It presents an encrypted-training protocol, an empirical privacy estimator, and results comparing the approach with a DP-only baseline.

I. INTRODUCTION

  • Although FL keeps raw data local, model updates can reveal confidential training information [1]–, and DP’s noise calibration for complex models remains challenging.HE protects encrypted computation, but plaintext models or inference results may still reveal training data and require additional privacy mechanisms.Source: §I · p. 1
  • The protocol uses HE for federated training and DP for intermittent model inspection and privacy-preserving downstream release.DP is applied to separate copies of global updates made available for inspection or downstream use.Source: §I · pp. 1–2

A. Contributions

  • A new attack strategy and corresponding test statistics support empirical privacy estimation in FL, extending the approach in.The estimator is intended to track privacy throughout training and downstream use.Source: A. Contributions · p. 2
  • The proposed HE-trained approach with DP applied to the final model maintains predictive accuracy while offering stronger estimated privacy than the DP-only alternative.The comparison is presented in Fig. 2.Source: A. Contributions · p. 2
  • Intermittent inspections preserve utility and yield estimated privacy comparable to or stronger than the DP-only baseline, with privacy increasing as inspections become less frequent.The comparison is presented in Fig. 3.Source: A. Contributions · p. 2

B. Outline

  • The paper proceeds from technical background and related work to the framework, experiments, and conclusion.Sections II–VI cover those topics, respectively.Source: B. Outline · p. 2

II. BACKGROUND

The background reviews federated averaging, homomorphic encryption, and differential privacy, then motivates empirical privacy estimation for complex models. It also situates this estimation in membership-inference attacks and their practical approximations.

A. Federated Learning

  • FedAvg iteratively aggregates selected clients’ local updates, while FedProx, Scaffold, and FedNova address data-heterogeneity challenges.The server computes a weighted average, with local dataset sizes determining client weights.Source: A. Federated Learning · p. 2

B. Homomorphic Encryption

  • Fully homomorphic encryption supports arbitrary computation on ciphertexts through bootstrapping, which refreshes accumulated noise and permits continued operations.CKKS is generally preferred for machine learning because it supports fixed-point numbers.Source: B. Homomorphic Encryption · p. 3

C. Differential Privacy

  • Differential privacy calibrates noise so outputs from neighboring datasets are nearly indistinguishable, balancing privacy against utility.Neighboring datasets typically differ by adding, removing, or replacing one individual’s data.Source: C. Differential Privacy · p. 3

1) Estimating DP:

  • Empirical DP estimation uses membership-inference attacks because theoretical guarantees can diverge from achieved privacy in complex models; practical attacks approximate the likelihood ratio test.Prior work uses frequentist confidence intervals or Bayesian credible intervals, while LOSS and LiRa provide attack approximations.Source: 1) Estimating DP · p. 3

III. RELATED WORK

Related work identifies limits in privacy-preserving FL, especially training-time inspection and privacy loss that accumulates with each model query. The paper situates its approach against these limits and specifies an individual-client setting for its protocol.

III. RELATED WORK

  • DP approaches in FL include centralized and local variants, while HE-based systems vary in key sharing, collusion resistance, and whether the server sees global updates [20]–.The cited related work describes utility challenges for LDP as model size increases and plaintext global updates in some HE systems.Source: §III · pp. 3–4
  • POSEIDON keeps training encrypted but makes training-time utility inspection infeasible and limits downstream queries when DP perturbation is applied to each output [28].The proposed method is designed to address both limitations.Source: §III · p. 4

A. System Setting

  • FL clients collaborate because their individual datasets may be too limited and unrepresentative to train an accurate model alone.The paper distinguishes populations of large institutions from populations of individual edge clients.Source: A. System Setting · p. 4
  • The protocol adopts the FL setting where each client represents one individual and holds a unique, limited dataset.The paper motivates this setting as a more conservative basis for estimating privacy loss than the alternative where a client holds multiple individuals’ data.Source: A. System Setting · p. 4

B. Limitations of Privacy-Preserving FL

The section describes privacy and monitoring limitations in encrypted FL, then motivates model perturbation and an auditing approach. It also outlines the cryptographic setup and encrypted training process.

B. Limitations of Privacy-Preserving FL

  • Perturbing each prediction spends privacy budget with every query, whereas releasing one DP-perturbed final model allows indefinite querying under DP post-processing.The proposed alternative applies calibrated DP noise to the final model rather than to each prediction output.Source: B. Limitations of Privacy-Preserving FL · p. 4
  • The privacy-auditing approach adapts Bayesian MCMC estimation from, using membership-inference attacks and test statistics tailored to the FL setting.It estimates privacy from attack performance to help select a noise level when tight theoretical bounds are difficult to derive.Source: B. Limitations of Privacy-Preserving FL · p. 4
  • Encrypted intermediate updates make it harder to assess convergence, decide when to stop, and detect potentially harmful low-quality or biased client data.Inspections on separately perturbed copies let clients test updates without adding noise to the non-noisy training trajectory.Source: B. Limitations of Privacy-Preserving FL · pp. 4–5

1) Cryptographic Setup:

  • MHE key shares are generated by participating clients, and decryption requires all K parties to contribute their shares.Clients homomorphically train on encrypted global updates, send encrypted local updates to the server, and the server aggregates them homomorphically.Source: 1) Cryptographic Setup · p. 5

2) Encrypted Federated Learning:

  • Each round selects a subset of the training cohort, whose clients train homomorphically from the same encrypted global update before aggregation.The selected subset is typically much smaller than the full cohort to reduce communication overhead.Source: 2) Encrypted Federated Learning · p. 5

3) Differentially Private Model Inspection:

The protocol uses DP-noised copies for intermediate inspection and adds noise to the final model before release, while training continues on the unperturbed encrypted model. Its privacy audit adapts Bayesian estimation and an attack definition to the FL threat model.

3) Differentially Private Model Inspection:

D. DP Estimation for FL

  • The MCMC-based Bayesian audit estimates a full posterior over privacy parameters and combines evidence from multiple attacks without assuming one attack or challenge base is worst-case.The method can accommodate statistical dependencies through joint probability models.Source: D. DP Estimation for FL · p. 5

E. Threat Model and Attack Definition

  • The threat model assumes honest-but-curious participants and server, considers the most revealing adversarial view, and allows collusion among up to |P|−1 clients excluding the server.The paper also describes an alternative interpretation as genuine membership inference when the challenge alternatives are two non-colluding clients.Source: E. Threat Model and Attack Definition · p. 6
  • Because colluding clients can infer an honest client’s participation from round membership, standard client membership-inference attacks are unsuitable for this threat model.The proposed attack instead distinguishes between two alternatives for the honest client’s dataset.Source: E. Threat Model and Attack Definition · p. 6

1) Training Algorithms:

The training algorithms differ in where DP noise is applied: throughout DP-only training, to inspection copies and release under HE training, or only to the final model under HE training. The HE-based variants retain the non-perturbed encrypted trajectory for training.

1) Training Algorithms:

  • A1 adds DP noise to local updates before every aggregation round and continues training from noisy global updates, without HE.This is the DP-only training baseline.Source: 1) Training Algorithms · p. 6
  • A2 trains with HE and applies DP to separate copies for intermittent inspection and to the final model for release; training continues from the unperturbed encrypted update.The inspection rounds may be as frequent or infrequent as needed and need not be periodic.Source: 1) Training Algorithms · pp. 6–7
  • The experiments match the variance of fresh Gaussian perturbations across algorithms; the stated equivalence to variance σ^2Id/Ks assumes equal selected-client dataset sizes.The HE-based procedure applies to both A2 and A3, with inspection or release rounds depending on the algorithm.Source: 1) Training Algorithms · p. 7
  • A3 trains under HE without intermediate inspection and adds DP noise only to the final global model before downstream release.A3 is described as A2 with intermediate inspection removed.Source: 1) Training Algorithms · p. 7

2) Adversary’s View:

The adversary’s strongest view differs by training algorithm: colluding clients can isolate a target client’s noisy updates in A1, while HE-based A2/A3 expose only perturbed global updates at inspection or release rounds. For equal contribution scales, the A2/A3 view is noisier, and the analysis attributes stronger privacy protection to server-added noise.

2) Adversary’s View:

  • In A1, colluding clients can identify the rounds when the honest client participated and isolate that client’s noisy local updates.Their strongest adversarial view is the information available to and inferred by those colluding clients.Source: 2) Adversary’s View · p. 7
  • In A2/A3, homomorphic training prevents direct access to local updates; the adversary’s strongest view is perturbed global updates revealed at inspection or release rounds.For A3, the inspection/release round set is {R}.Source: 2) Adversary’s View · p. 7
  • At the same scale of individual contributions in revealed models, the A2/A3 adversarial view is noisier, and the analysis indicates non-colluding-server noise offers stronger privacy protection.The comparison assumes equal numbers of clients per subset.Source: 2) Adversary’s View · pp. 7–8

3) MIA tailored for DP:

The privacy estimator adapts membership-inference testing to FL by comparing training runs under two target-data hypotheses using the attacker’s most informative view. Shadow-model statistics provide hypothesis distributions, and a fixed evaluation dataset keeps their losses comparable.

3) MIA tailored for DP:

  • For each challenge base, the FL algorithm runs under H0 and H1, using alternative target-individual datasets while the attacker receives the most informative model sequence in its view.The target individual corresponds to the honest client in the threat model.Source: 3) MIA tailored for DP · p. 8
  • The attacker learns the H0 and H1 test-statistic distributions from shadow models, then compares the observed statistic from actual training to decide which target dataset was used.The cited LearnAndDecide algorithm describes the distribution-learning and decision procedure.Source: 3) MIA tailored for DP · p. 8
  • The test statistic fixes the loss dataset at Z0 under both hypotheses so the underlying distributions are compared on the same data.ℓ(θ, Z) denotes the model’s unsmoothed loss on dataset Z.Source: 3) MIA tailored for DP · p. 8

V. EXPERIMENTAL RESULTS

The experiments use FEMNIST, whose client-partitioned handwriting data is heterogeneous and unbalanced. The study samples 188 clients and divides each individual’s data into training and test subsets.

A. Dataset

  • FEMNIST is naturally partitioned across clients with heterogeneous data and substantially varying sample counts, reflecting non-i.i.d. and unbalanced FL data.The dataset comes from LEAF, a benchmarking framework for federated-learning settings.Source: A. Dataset · p. 8
  • The experimental population is a random FEMNIST subset of 188 handwriters, each contributing samples across a subset of 62 characters.Source: A. Dataset · p. 8
  • Each individual’s data is split into training and test subsets at a training ratio of 0.8.Source: A. Dataset · p. 8

B. FL Setup

The FEMNIST experiments compare HE-based training with DP at release or inspection against DP-only training. At round 500, release-only DP achieves lower test loss and lower estimated privacy loss than the DP-only baseline; inspection frequency and noise level also shape the reported privacy–utility results.

B. FL Setup

  • The FL setup selects 100 participants, samples 5 clients per round, and runs 500 rounds with one local epoch; the model is a lightweight CNN for FEMNIST.Training uses batch size 16, SGD with momentum 0.9, learning rate 0.01, and label smoothing of 0.01.Source: B. FL Setup · pp. 8–9, Table I · p. 9

1) Challenge Construction:

  • Challenge construction uses 20 bases, each with 100 individuals under either hypothesis; privacy estimates are reported from round 100 because earlier attack estimates are considered unreliable.The unit client noise in A1 is zero-mean Gaussian with σ = 0.02 unless specified otherwise.Source: 1) Challenge Construction · p. 9

1) Privacy and Effects on Utility:

  • Privacy estimates use posterior mean ϵ for the most informative target-client models; each A3 round is treated as a possible final release, while utility averages test loss over 100 shadow models.Utility uses one challenge base under H0; the A3 estimates correspond to releasing the DP-perturbed model at that round.Source: 1) Privacy and Effects on Utility · p. 9
  • Even at P = 1, A2’s final posterior mean ϵ is 8.43 versus 9.13 for A1, with the study reporting preserved utility under HE-based training.P = 1 means every global model is inspected.Source: 1) Privacy and Effects on Utility · p. 9, Figure 3 · p. 10
  • In the A2 evaluation, P is the inspection period; less frequent inspections improve estimated privacy, though the A2-versus-A1 result may differ with noise variance, architecture, FL setup, or data.For example, P = 10 means inspecting every tenth model during 500 rounds.Source: 1) Privacy and Effects on Utility · p. 9, Figure 3 · p. 10
  • In A3, increasing Gaussian noise variance increases estimated privacy while decreasing model utility.The authors frame this as a privacy–accuracy trade-off.Source: 1) Privacy and Effects on Utility · p. 9
  • At round 500 with σ = 0.07, A3 has test loss 1.09 versus 2.37 for A1 and posterior mean ϵ 4.32 versus 7.26, respectively.The comparison is shown in Fig. 2(b).Source: 1) Privacy and Effects on Utility · p. 9, Figure 2 · p. 10
  • At round 500 with σ = 0.02, A3 has test loss 0.86 versus 1.00 for A1 and posterior mean ϵ 6.02 versus 9.13, respectively.The comparison is shown in Fig. 2(a), and the reported trend persists through the remainder of training.Source: 1) Privacy and Effects on Utility · p. 9, Figure 2 · p. 10

2) FHE Simulation:

The FHE simulation tests whether encrypted-training approximations materially alter utility, and the conclusion reports better utility and estimated privacy than DP-only training. The section also identifies computational costs and future work for full homomorphic implementation.

2) FHE Simulation:

  • Privacy estimation requires 4,000 FL runs in this setting, making fully homomorphic training of all shadow models computationally impractical.Homomorphic operations can be orders of magnitude more expensive than cleartext operations; HE-based CIFAR-10 CNN training has been reported to take up to a week [28].Source: 2) FHE Simulation · p. 10
  • In A3, increasing Gaussian noise variance raises estimated privacy while reducing model utility.Fig. 4 plots posterior mean epsilon and mean test loss across five sigma values.Source: Figure 4 · p. 11
  • The FHE simulation models nonlinear-operation approximations and CKKS numerical noise to test whether these factors change the training trajectory.It uses simulated FHE for A2/3, approximating ReLU and softmax and propagating estimated CKKS noise through operations.Source: 2) FHE Simulation · p. 11
  • After rudimentary convergence, FHE-simulated A2/3 has negligible test-loss increase versus cleartext A2/3 and does not perform below A1.Fig. 5 compares test loss for FHE-simulated A2/3, cleartext A2/3, and A1.Source: Figure 5 · p. 11, 2) FHE Simulation · p. 11

VI. CONCLUSION

  • The proposed protocol provides better utility and greater estimated privacy than DP-only training, and limits utility loss by perturbing only visible models.The conclusion attributes avoided noise accumulation to perturbing only the final layer of visible models.Source: §VI · p. 11
  • Full homomorphic implementation and more efficient nonlinear approximations remain future work for investigating computational and communication costs.The conclusion also identifies non-periodic inspections and extensions to definition (a) and anomaly detection as future directions.Source: §VI · pp. 11–12

APPENDIX A EXTENDED THREAT MODEL

The extended threat model considers semi-honest collusion between the server and clients. Under that setting, A1 retains its T1 privacy guarantees, while A2/3 requires noise that remains in inspected models even when a client is absent.

APPENDIX A EXTENDED THREAT MODEL

  • The threat-model extension treats the server and colluding clients as semi-honest entities, while T1 assumes the server cannot collude.Source: Appendix A · p. 13

A. A1 (DP-only baseline)

  • Under T2, A1 retains its T1 privacy guarantees, although the colluding parties know honest clients' identities, removing standard membership-inference implications.Source: A. A1 (DP-only baseline) · p. 13

B. A2/3 (HE-based training)

  • Under server collusion, A2/3's server can subtract inspection noise and, with colluding clients' updates, reconstruct an honest client's update.Source: B. A2/3 (HE-based training) · p. 13
  • A2/3 can expose an honest client's contribution without noise, while the analyzed colluding-client setting also leaves that contribution subject to less noise.The passage compares the effective noise protecting the honest client's contribution under the extended threat model.Source: B. A2/3 (HE-based training) · p. 13
  • The proposed A2/3 scheme has every client contribute encrypted Gaussian noise, keeping an honest client's noise in the inspected update even under server-and-client collusion.Clients collectively decrypt and publish the noisy update for inspection.Source: B. A2/3 (HE-based training) · p. 13
  • Inspections provide less privacy per round under collusion because colluding clients can remove their noise from the inspected model.Source: B. A2/3 (HE-based training) · p. 13

Related papers

Loading 2610.01650v1…