PaperlayerView exact revision on arXiv

Source-linked AI summary

Privacy-Preserving Federated Loss Exploration for Vision-Based Perception under Non-IID Data

Nergiz Yuca, Christian Internò, Nikolay Matyunin, Markus Olhofer, Barbara Hammer, Stefan Katzenbeisser

arXiv:2610.32626v1cs.CR

TL;DR

Non-IID data complicates federated learning for vehicular vision, while gradient-guided optimization can expose private client information. PPFLex uses MPC servers to compute FedLEx guidance and model aggregation privately; the reported attack infers client label distributions with 50%–84% accuracy, but cannot be launched under PPFLex.

  • Problem

    Non-IID client data challenges federated learning, while secure aggregation focused on standard averaging does not protect the additional gradient information used by methods such as FedLEx.

    Source: §I · pp. 1–2

  • Method

    PPFLex replaces FedLEx’s centralized server with three MPC servers that securely compute global guidance and perform federated averaging.

    Source: §IV · p. 4

  • Results

    50%–84% accuracy: a malicious server inferred client-specific label distributions, while the presented attack cannot be launched under PPFLex.

    Source: B. An Analysis of Privacy Leakage in… · p. 6

  • Takeaways & Limitations

    The findings emphasize the need for optimized protocols and tailored MPC implementations to improve efficiency and extend scalability to larger models and more clients.

    Source: §VII · p. 7

    The evaluation focuses on traffic-sign classification as a representative automotive perception task; traffic-sign detection is out of scope.

    Source: §I · p. 2

Abstract

from arXiv · show

Vision-based image classification models benefit from Federated Learning (FL) across vehicles, however learning accurate models from distributed vehicular cameras is challenging due to data heterogeneity and privacy concerns. To improve performance on non-IID data, advanced FL optimization approaches have emerged that share auxiliary insights, such as client gradient behaviors. While these gradient-guided optimized FL methods improve the model accuracy, their reliance on sharing additional gradient information introduces a previously unexplored privacy vulnerability. In our empirical privacy-leakage experiment, we show that a malicious server can infer clients' label sets from shared guidance matrices under heterogeneous client label distributions (simulated via Dirichlet-based label partitions), between 50% and 84% accuracy. To address this privacy leakage, we propose PPFLex that replaces the central server with three Secure Multi-Party Computation (MPC) servers to securely compute the global guidance matrix and perform federated averaging under semi-honest and malicious MPC server assumptions. We evaluate PPFLex on widely used traffic-sign classification datasets (e.g., GTSRB and BTSC) as representative autonomous vehicle perception benchmarks, comparing against baselines. Our results show that PPFLex achieves accuracy comparable to the plain-text FedLEx pipeline while preventing privacy leakage, incurring acceptable MPC overhead.

I. INTRODUCTION

Vehicular vision models face non-IID data and privacy concerns: FedLEx uses shared gradient information to address heterogeneity, but that information can reveal client label distributions. PPFLex combines non-IID optimization with MPC-based privacy protection, evaluated for traffic-sign classification.

I. INTRODUCTION

  • Traffic-sign distributions may reveal vehicles’ driving profiles, including recurring routes or location-based behavior, despite FL’s avoidance of raw-data sharing.FL supports collaborative training without sharing raw data, but intermediate updates remain vulnerable to inference attacks.Source: §I · pp. 1–2
  • Vehicles encounter different sign distributions and environmental conditions, making their data non-IID and challenging standard FedAvg aggregation.Divergent local updates can reduce generalization across clients.Source: §I · p. 1
  • PPFLex combines non-IID optimization with MPC privacy protection, addressing a gap between gradient-guided methods and secure aggregation designed for standard averaging.The framework targets traffic-sign classification and privately computes FedLEx guidance.Source: §I · p. 2
  • Traffic-sign classification is the representative perception task; traffic-sign detection under motion blur, glare, and adverse weather is out of scope.The evaluation uses GTSRB and BTSC under non-IID client partitions.Source: §I · p. 2
  • FedLEx’s additional shared gradient information can expose clients’ privacy-sensitive data, a vulnerability evaluated on GTSRB and BTSC.The paper studies the leakage in traffic-sign classification.Source: §I · p. 2
  • The work studies accuracy, privacy, and communication/computational overhead across MPC protocols and semi-honest and malicious server assumptions.The stated evaluation concerns trade-offs across protocols and security assumptions.Source: §I · p. 2

II. RELATED WORK

Prior work covers privacy-preserving aggregation in FL and methods for non-IID optimization, but the reviewed secure aggregation protocols do not address non-IID optimization challenges.

II. RELATED WORK

  • The related-work review spans secure aggregation, non-IID optimization, and FL for traffic-sign classification.This overview frames the section’s three topics.Source: §II · p. 2

A. Secure Aggregation in FL

  • Existing MPC secure-aggregation protocols protect FL model sharing but do not address optimization challenges caused by non-IID client distributions.The review describes protocols targeting model privacy, robustness, or communication efficiency.Source: A. Secure Aggregation in FL · p. 2

B. Optimizing FL on Non-IID Data

The section reviews approaches to non-IID federated learning and traffic-sign classification, then explains how FedLEx explores client loss landscapes and uses global guidance to modulate local updates.

B. Optimizing FL on Non-IID Data

  • Non-IID FL studies use transfer learning, distillation, client clustering, distribution modeling, and adaptive optimization; the section identifies MPC-integrated loss-geometry transfer as an open gap.The cited approaches include, [34],,,, [38],, and [40].Source: B. Optimizing FL on Non-IID Data · p. 2

C. FL in Traffic Sign Classification

  • Prior traffic-sign FL work targets accuracy, efficiency, or architecture, while PPFLex targets privacy risks from non-IID optimization values through MPC.Examples include decentralized detection with FedAvg and FedProx [7], communication-efficient training, and data-free distillation.Source: C. FL in Traffic Sign Classification · p. 3

III. BACKGROUND: FEDERATED LOSS EXPLORATION

  • FedLEx uses a loss exploration phase to identify parameters sensitive to client-data differences, then uses global guidance to modulate local updates.Clients derive local guidance from squared parameter deviations; the global matrix is aggregated and normalized before being returned to clients.Source: §III · p. 3
  • FedLEx aggregates and min-max normalizes clients’ local guidance matrices, then scales each local parameter update by the global guidance before federated averaging.Each global-matrix entry represents the average gradient deviation for a parameter across clients.Source: §III · p. 3

IV. PROPOSED PPFLEX FRAMEWORK

PPFLex replaces FedLEx’s centralized server with MPC servers that securely compute global guidance and federated averaging. Its security assumptions cover semi-honest and malicious servers, but not malicious clients.

IV. PROPOSED PPFLEX FRAMEWORK

  • Three MPC servers receive secret-shared client inputs and jointly compute the global guidance matrix and federated average without reconstructing raw client inputs.The framework generally supports two or more servers; three are used to evaluate protocols with different majority assumptions.Source: §IV · p. 4
  • PPFLex targets traffic-sign classification, where label distributions reflect road environments and exploration updates may reveal information about local driving environments.Vehicles periodically contribute camera data, while an OEM or mobility provider coordinates training.Source: §IV · p. 4
  • The threat model assumes semi-honest clients and three non-colluding MPC servers; malicious-client defenses are outside the framework’s scope.For three-server replicated protocols, at most one corrupted server is assumed; SPDZ2k security requires at least one honest computation party.Source: §IV · p. 5
  • Clients can upload local guidance shares once for reuse across rounds, avoiding repeated uploads without reconstructing guidance in plaintext.Source: §IV · p. 5

V. IMPLEMENTATION

PPFLex implements secure aggregation and guidance computation using MP-SPDZ, with client-side normalization and a unified aggregation program. The existing FedLEx pipeline is adapted to exchange inputs with MPC parties.

V. IMPLEMENTATION

  • The implementation uses MP-SPDZ to evaluate the secure federated-learning pipeline under different protocols and security settings.Source: §V · p. 5
  • Client-side guidance-matrix normalization avoids costly MPC min/max operations, while a unified secure program handles gradient updates and local guidance matrices.The program stores results in the filesystem.Source: §V · p. 5
  • The FedLEx pipeline dumps model updates and local matrices to files, converts them to fixed-point integers, and invokes MPC clients and computing parties.These changes replace plain-text operations in the existing pipeline.Source: §V · p. 5

VI. EVALUATION

The evaluation covers non-IID traffic-sign classification, guidance-information privacy leakage, MPC’s effect on accuracy, and MPC overhead. It uses GTSRB and BTSC, with experiments varying client counts and settings by evaluation task.

VI. EVALUATION

  • The evaluation uses GTSRB, with 26,640 images across 43 classes, and BTSC, with 4,591 training and 2,534 test images across 62 subclasses.BTSC is included to evaluate cross-dataset generalization under distribution shifts.Source: §VI · p. 5
  • Experiments use TwoCNN with 1,681,899 trainable parameters; client counts vary by task, including 120 simulated clients for privacy-leakage evaluation.MPC measurements use three servers on Google Cloud virtual machines in a 10 GB LAN setting.Source: §VI · pp. 5–6
  • FedLEx outperforms FedAvg across Dirichlet heterogeneity levels on both GTSRB and BTSC.Source: Figure 3 · p. 6

A. FedLEx Performance under Non-IID Traffic Sign Data

FedLEx outperforms FedAvg on both traffic-sign datasets across heterogeneity levels, with a larger gap under more skewed client data and lower variance across runs.

A. FedLEx Performance under Non-IID Traffic Sign Data

  • The comparison tests Dirichlet α values of 0.1, 0.5, and 1.0; smaller α indicates more skewed local class distributions.Each configuration is repeated over five independent runs, reporting mean accuracy with ±1 standard deviation.Source: A. FedLEx Performance under Non-IID… · p. 6
  • 18.66% on GTSRB and 28.75% on BTSC: FedLEx’s absolute accuracy margins over FedAvg at α=0.1.FedLEx also shows lower variance across runs, indicating more stable training under non-IID conditions.Source: A. FedLEx Performance under Non-IID… · p. 6
  • Across both datasets and all tested heterogeneity levels, FedLEx consistently outperforms FedAvg.Source: A. FedLEx Performance under Non-IID… · p. 6

B. An Analysis of Privacy Leakage in FedLEx

The experiment tests whether a malicious server can infer clients’ dominant traffic-sign classes from FedLEx gradient deviations. The attack reaches 50%–84% accuracy across configurations on GTSRB and BTSC.

B. An Analysis of Privacy Leakage in FedLEx

  • The experiment used 120 clients with 1–4 classes each, Dirichlet-drawn class proportions, and 300 samples per client.A Random Forest predicted dominant classes from element-wise squared parameter deviations; evaluation used an 80/20 split and 5-fold cross-validation, against an approximately 2% random-guessing baseline.Source: B. An Analysis of Privacy Leakage in… · p. 6
  • 50%–84% attack accuracy was achieved for predicting clients’ dominant traffic-sign classes from gradient deviations, depending on configuration.Fig. 4 groups results by classes per client and data heterogeneity for GTSRB and BTSC.Source: B. An Analysis of Privacy Leakage in… · p. 6, Figure 4 · p. 6
  • Attack accuracy was highest with fewer classes per client and at α=0.2, and the reported risk occurred on both datasets.The α=0.1 and α=0.3 results were comparable but lower than α=0.2.Source: B. An Analysis of Privacy Leakage in… · p. 6, Figure 4 · p. 6

C. MPC Impact on Model Accuracy

The MPC extensions preserve the convergence behavior of the plain-text FedLEx pipeline, with small discrepancies attributed to quantization.

C. MPC Impact on Model Accuracy

  • After 100 training rounds, FedLEx and PPFLex convergence curves closely aligned, with small discrepancies attributed to quantized floating-point operations under MPC.The comparison averaged results across five runs and was used to verify that MPC additions did not affect overall FL performance.Source: C. MPC Impact on Model Accuracy · p. 6

D. MPC Overhead

The MPC overhead evaluation covers secure federated averaging and guidance-matrix computation with the 2CNN model on GTSRB. Overhead depends substantially on input sharing and protocol security assumptions.

D. MPC Overhead

  • Client-side share generation reduced Replicated2k total time from 1148.8s to 20.5s by eliminating server-side preprocessing for semi-honest protocols.The guidance-matrix normalization step is performed locally; server-side masking, when required, can be preprocessed offline.Source: D. MPC Overhead · pp. 6–7
  • With server-side input masking, total execution time ranged from 1148.8s for Replicated2k to 6233.8s for SPDZ2k; SPDZ2k generated over 285 GB offline.SPDZ2k’s higher cost reflects malicious security under a dishonest majority and MAC-authenticated preprocessing; PSReplicated2k provides malicious security under an honest majority at moderate cost.Source: D. MPC Overhead · p. 7
  • Semi2k and Replicated2k completed within approximately 30s with client-side share generation, while malicious-security preprocessing can be scheduled during vehicle downtime.The comparison covers six protocol configurations and reports offline and online phases separately; Table II covers three-party protocols over Z2k for averaging and guidance computation.Source: D. MPC Overhead · pp. 6–7, Table II · p. 7

VII. CONCLUSION

The conclusion reports that gradient deviations in FedLEx expose client-specific label distributions, motivating PPFLex’s three-server MPC design. It also highlights protocol runtime and communication trade-offs and the need for efficient implementations as deployments scale.

VII. CONCLUSION

  • Table III reports MPC overhead scaling with the number of FL clients, while the conclusion calls for optimized protocols and tailored implementations to improve efficiency and scalability.The stated scaling target includes larger models and more clients.Source: Table III · p. 7, §VII · p. 7
  • A malicious server inferred client-specific label distributions from gradient deviations with 50%–84% accuracy on real traffic-sign datasets.The conclusion identifies FedLEx as the focus of the privacy-risk analysis.Source: §VII · p. 7
  • PPFLex replaces single-server aggregation with three MPC servers that securely compute global guidance and model aggregation.The evaluation compared ring-based protocols and quantified runtime and communication trade-offs under different security assumptions.Source: §VII · p. 7

Related papers

Loading 2610.32626v1…