Preserving Privacy in Federated Learning Systems through a Secure Multi-Layer Defense Framework against Security Threats
Keywords:
Differential privacy, Distributed machine learning, Federated Learning, Privacy-preserving AI, Robust aggregation, Secure aggregationAbstract
Although Federated Learning (FL) permits collaboration in model training with local data being kept private, model updates may be attacked by gradient leakage, model poisoning, membership inference, and eavesdropping. To combat these multi-vector attacks, the study proposes the Secure Multi-Layer Defense Framework (SMLDF), an architecture in which security measures are distributed across the three layers of client, communication, and server. Client-side security includes gradient clipping and Differential Privacy (DP), which limit the impact of individual samples and introduce noise to prevent reconstruction and inference attacks before updates are sent out of local machines. In the communication and summation layer, secure protocols and Secure Aggregation provide protection for gradient updates on the way. Anomaly detection and robust aggregation at the server side detect poisoned gradient updates from malicious clients. As per the qualitative analysis conducted, the framework will ensure a balance between the effectiveness of the model, resilience to multi-vector attacks, privacy, and communication. The framework is the foundation for future experiments using benchmarks such as FEMNIST and CIFAR-10. It compares model performance, multi-vector attack prevention capability, privacy guarantee, and communication cost with current FL security models. SMLDF sets up the foundation for future experiments on federated systems, where benchmark datasets such as FEMNIST and CIFAR-10 will be used in adversarial settings.
References
H. B. McMahan, E. Moore, D. Ramage, S. Hampson, and B. A. y Arcas, “Communication-efficient learning of deep networks from decentralized data,” arXiv, Feb. 2016.
K. Bonawitz et al., “Practical secure aggregation for privacy-preserving machine learning,” Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Oct. 2017, pp. 1175–1191.
M. Abadi et al., “Deep learning with differential privacy,” Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security - CCS’16, Oct. 2016, pp. 308–318.
R. Shokri, M. Stronati, C. Song and V. Shmatikov, “Membership inference attacks against machine learning models,” 2017 IEEE Symposium on Security and Privacy (SP), San Jose, CA, USA, 2017, pp. 3–18.
M. Nasr, R. Shokri, and A. Houmansadr, “Comprehensive privacy analysis of deep learning: Passive and active white-box inference attacks against centralized and federated learning,” 2019 IEEE Symposium on Security and Privacy (SP), vol. 1, pp. 739–753, May 2019.
L. Zhu, Z. Liu, and S. Han, “Deep leakage from gradients,” Proceedings of the 33rd International Conference on Neural Information Processing Systems, Jan. 2019, pp. 14774–14784.
P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” in Proceedings of the 31st International Conference on Neural Information Processing Systems, Dec. 2017, pp. 118–128.
D. Yin, Y. Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” arXiv, Feb. 2021.
E. Bagdasaryan, A. Veit, Y. Hua, D. Estrin, and V. Shmatikov, “How to backdoor federated learning,” arXiv, Aug. 2019.
Y. Liu, P. Jiang, and L. Zhu, “Subject-level membership inference attack via data augmentation and model discrepancy,” IEEE Transactions on Information Forensics and Security, vol. 18, pp. 5848–5859, 2023.
R. Behnia, A. Riasi, R. Ebrahimi, S. S. M. Chow, B. Padmanabhan, and T. Hoang, “Efficient secure aggregation for privacy-preserving federated machine learning,” 2024 Annual Computer Security Applications Conference (ACSAC), Dec. 2024, pp. 778–793.
S. Kadhe, N. Rajaraman, O. O. Koyluoglu, and K. Ramchandran, “FastSecAgg: Scalable secure aggregation for privacy-preserving Federated Learning,” arXiv, Sept. 2020.
D. Pasquini, D. Francati, and G. Ateniese, “Eluding secure aggregation in Federated Learning via model inconsistency attacks,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, 2022, pp. 2429–2443.
W.-N. Chen, C. A Choquette Choo, P. Kairouz, A. T. Suresh, “The fundamental price of secure aggregation in differentially private Federated Learning,” in Proceedings of the 39th International Conference on Machine Learning, 2022, pp. 3056–3089.
Q. Li et al., “A survey on Federated Learning systems: Vision, hype and reality for data privacy and protection,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 4, pp. 3347–3366, Apr. 2023.
X. Yin, Y. Li, C. Bai, Q. Han and Y. Chen, “Enhancing membership inference attacks in Federated Learning based on overfitting property,” 2024 20th International Conference on Mobility, Sensing and Networking (MSN), Harbin, China, 2024, pp. 989–996.
A. R. Elkordy, J. Zhang, Yahya H, Ezzeldin, K. Psounis, and S. Avestimehr, “How much privacy does Federated Learning with secure aggregation guarantee?,” arXiv, Aug. 2022.
Y. Li, J. Lai, R. Zhang, and M. Sun, “Secure and efficient multi-key aggregation for federated learning,” Information Sciences, vol. 654, Jan. 2024.
