How Much Privacy Does Federated Learning with Secure Aggregation Guarantee?
How Much Privacy Does Federated Learning with Secure Aggregation Guarantee?
复制标题
DOI：
10.48550/arxiv.2208.02304
复制
发表时间：
2022-08
期刊：
影响因子：
--
通讯作者：
A. Elkordy;Jiang Zhang;Yahya H. Ezzeldin;K. Psounis;A. Avestimehr
中科院分区：
文献类型：
--
作者：
A. Elkordy;Jiang Zhang;Yahya H. Ezzeldin;K. Psounis;A. Avestimehr
联邦学习（FL）因能够在多个用户存储的数据上进行保护隐私的机器学习，同时避免数据离开设备而受到越来越多的关注。然而，尽管数据从未离开用户设备，但由于对用户训练数据的重要计算是以训练后的本地模型的形式共享的，隐私仍然无法得到保证。最近已表明，这些本地模型通过不同的隐私攻击（如模型反转攻击）构成了重大的隐私威胁。作为一种补救措施，安全聚合（SA）已被开发为一种在联邦学习中保护隐私的框架，它确保服务器只能了解全局聚合模型更新，而无法了解单个模型更新。虽然安全聚合确保除了聚合模型更新之外，单个模型更新不会泄露额外信息，但对于带有安全聚合的联邦学习实际上能提供多少隐私并没有正式的保证；因为关于单个数据集的信息仍有可能通过服务器计算的聚合模型泄露。在这项工作中，我们对带有安全聚合的联邦学习的正式隐私保证进行了首次分析。具体来说，我们使用互信息（MI）作为量化指标，并推导出关于每个用户数据集的信息通过聚合模型更新可能泄露多少的上限。当使用FedSGD聚合算法时，我们的理论界限表明，隐私泄露量随着参与带有安全聚合的联邦学习的用户数量线性减少。为了验证我们的理论界限，我们使用一个互信息神经估计器，在MNIST和CIFAR10数据集上的不同联邦学习设置下，对隐私泄露进行实证评估。我们的实验验证了FedSGD的理论界限，即随着用户数量和本地批量大小的增加，隐私泄露减少，随着训练轮数的增加，隐私泄露增加。我们还观察到FedAvg和FedProx协议也有类似的相关性。
Federated learning (FL) has attracted growing interest for enabling privacy-preserving machine learning on data stored at multiple users while avoiding moving the data off-device. However, while data never leaves users’ devices, privacy still cannot be guaranteed since significant computations on users’ training data are shared in the form of trained local models. These local models have recently been shown to pose a substantial privacy threat through different privacy attacks such as model inversion attacks. As a remedy, Secure Aggregation (SA) has been developed as a framework to preserve privacy in FL, by guaranteeing the server can only learn the global aggregated model update but not the individual model updates.While SA ensures no additional information is leaked about the individual model update beyond the aggregated model update, there are no formal guarantees on how much privacy FL with SA can actually offer; as information about the individual dataset can still potentially leak through the aggregated model computed at the server. In this work, we perform a first analysis of the formal privacy guarantees for FL with SA. Specifically, we use Mutual Information (MI) as a quantification metric and derive upper bounds on how much information about each user's dataset can leak through the aggregated model update. When using the FedSGD aggregation algorithm, our theoretical bounds show that the amount of privacy leakage reduces linearly with the number of users participating in FL with SA. To validate our theoretical bounds, we use an MI Neural Estimator to empirically evaluate the privacy leakage under different FL setups on both the MNIST and CIFAR10 datasets. Our experiments verify our theoretical bounds for FedSGD, which show a reduction in privacy leakage as the number of users and local batch size grow, and an increase in privacy leakage as the number of training rounds increases. We also observe similar dependencies for the FedAvg and FedProx protocol.