arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2409.17201cs.CRcs.LG

基于浸入与不变性的隐私保护联邦学习编码

Immersion and Invariance-based Coding for Privacy-Preserving Federated Learning

Eindhoven University of Technology(埃因霍温理工大学);Singapore University of Technology and Design(新加坡科技设计大学)

Haleh Hayati, Carlos Murguia, Nathan van de Wouw

AI总结:

针对联邦学习中模型更新易泄露数据信息且现有隐私保护方法存在性能或效率权衡的问题,提出结合差分隐私与系统浸入工具的框架,可定制隐私级别且保持标准联邦学习的精度与收敛速度。

摘要:

联邦学习(FL)已成为协作分布式学习中保护隐私的一种方法。在FL中,客户端直接在其设备上训练AI模型,而非将数据共享给可能带来隐私风险的中心化服务器。然而,研究表明,尽管FL对本地数据隐私提供了部分保护,但在训练期间仍可从共享的模型更新中推断出客户端数据的相关信息。近年来,已有多种隐私保护方法被开发以缓解FL中的这种隐私泄露问题,不过它们往往以牺牲模型性能或系统效率为代价来提供隐私保护。平衡这些权衡在实施FL方案时构成了重大挑战。在本手稿中,我们提出了一种结合差分隐私和控制理论中系统浸入工具的隐私保护FL框架。核心思想是将标准FL方案中使用的优化算法(例如基于梯度的算法)视为一个动态系统,我们试图将其浸入一个更高维的系统(称为目标优化算法)中。目标算法的动力学设计满足三个条件:首先,原始算法的模型参数被浸入其参数中;其次,它对失真参数进行操作;第三,它收敛到原始算法真实模型参数的编码版本。这些编码参数随后可在服务器端解码以恢复原始模型参数。我们证明,所提出的隐私保护方案可定制为对本地和全局模型参数提供任意期望级别的差分隐私,同时保持与标准FL算法相同的精度和收敛速度。

英文摘要:

Federated learning (FL) has emerged as a method to preserve privacy in collaborative distributed learning. In FL, clients train AI models directly on their devices rather than sharing data with a centralized server, which can pose privacy risks. However, it has been shown that despite FL's partial protection of local data privacy, information about clients' data can still be inferred from shared model updates during training. In recent years, several privacy-preserving approaches have been developed to mitigate this privacy leakage in FL, though they often provide privacy at the cost of model performance or system efficiency. Balancing these trade-offs presents a significant challenge in implementing FL schemes. In this manuscript, we introduce a privacy-preserving FL framework that combines differential privacy and system immersion tools from control theory. The core idea is to treat the optimization algorithms used in standard FL schemes (e.g., gradient-based algorithms) as a dynamical system that we seek to immerse into a higher-dimensional system (referred to as the target optimization algorithm). The target algorithm's dynamics are designed such that, first, the model parameters of the original algorithm are immersed in its parameters; second, it operates on distorted parameters; and third, it converges to an encoded version of the true model parameters from the original algorithm. These encoded parameters can then be decoded at the server to retrieve the original model parameters. We demonstrate that the proposed privacy-preserving scheme can be tailored to offer any desired level of differential privacy for both local and global model parameters, while maintaining the same accuracy and convergence rate as standard FL algorithms.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑