Federated Learning (FL) is widely regarded as an effective privacy-preserving learning framework, as it keeps clients’ training data local while only transmitting model updates. However, the Gradient Leakage Attack (GLA) can reconstruct clients’ local data through transmitted gradients, posing a significant privacy threat to FL. Existing defense strategies against the GLA have the following limitations: (1) cryptography-based defenses impose high computational and communication costs, rendering them impractical for the typically resource-constrained FL clients; (2) perturbation-based defenses fail to dynamically adapt to the unique characteristics of each client’s data, challenging the achievement of good utility-privacy trade-offs. To overcome these limitations, we introduce ANOM (Adaptive Noise Optimization Mechanism), a novel defense mechanism that customizes noise to align with local data attributes, thereby achieving a more favorable utility-privacy trade-off. Our comprehensive experimental evaluation demonstrates ANOM’s superior capability to balance utility and privacy. Across all defenses, ANOM results in the minimal accuracy reduction on public datasets when compared to the unprotected model scenario. In terms of privacy preservation, ANOM outperforms the current state-of-the-art defense, Outpost, in nearly all assessed experimental settings.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Tailoring Noise to Fit: An Adaptive Noise Optimization Mechanism Against Gradient Leakage

  • Haifeng Yuan,
  • Haihang Wang

摘要

Federated Learning (FL) is widely regarded as an effective privacy-preserving learning framework, as it keeps clients’ training data local while only transmitting model updates. However, the Gradient Leakage Attack (GLA) can reconstruct clients’ local data through transmitted gradients, posing a significant privacy threat to FL. Existing defense strategies against the GLA have the following limitations: (1) cryptography-based defenses impose high computational and communication costs, rendering them impractical for the typically resource-constrained FL clients; (2) perturbation-based defenses fail to dynamically adapt to the unique characteristics of each client’s data, challenging the achievement of good utility-privacy trade-offs. To overcome these limitations, we introduce ANOM (Adaptive Noise Optimization Mechanism), a novel defense mechanism that customizes noise to align with local data attributes, thereby achieving a more favorable utility-privacy trade-off. Our comprehensive experimental evaluation demonstrates ANOM’s superior capability to balance utility and privacy. Across all defenses, ANOM results in the minimal accuracy reduction on public datasets when compared to the unprotected model scenario. In terms of privacy preservation, ANOM outperforms the current state-of-the-art defense, Outpost, in nearly all assessed experimental settings.