Collaborative Research: SaTC: EAGER: Trustworthy and Privacy-preserving Federated Learning

机器学习(ML)模型中训练数据的用户隐私被以多种方式利用，导致联合学习(FL)领域的迅速扩大，这一事实已经引起了研究人员和公众的警觉。在FL中，ML模型的学习直接在用户设备上执行，而聚合模型是在中央服务器的帮助下组成的。由于数据永远不会离开用户设备，这一新模式提供了保护数据隐私的关键承诺。不幸的是，它在安全和隐私方面都提出了新的挑战。一方面，恶意用户可以通过向模型更新注入后门来危害安全性，从而毒化聚合模型。另一方面，存在隐私泄露的风险，因为不受信任的服务器可能会反向模型更新以公开私有数据。该项目开发了一个原则性和系统性的FL框架，同时提供隐私和安全保护，以抵御恶意用户和服务器的威胁。作为该项目的一部分，将开发新的协议，以确保可验证性、执行完整性、模型保密性和针对对手攻击的保护。该项目的成功在将机器学习扩展到新的应用场景方面具有巨大的潜力，特别是在利益相关者之间没有信任的情况下。这些发现还可能有益于其他领域，如零知识证明、分布式机器学习和分布式分类账技术。该项目涉及所有级别的学生，重点是吸引来自代表性不足群体的学生和K-12学生。该项目的重点是开发一个原则性的和系统的FL框架，包括三个共同的关键组件：1)轻量级的安全聚集和后门检查机制，其中每个用户负责安全地聚合他们的价值和证明无攻击模型；2)简洁的非交互知识论点(SNARK)证明，最大限度地减少非算术运算，以保持高精度和通信效率；以及3)基于区块链的FL体系结构，在培训过程的不同阶段紧密结合安全措施，为整个培训过程提供隐私和安全保护。通过转移证明该模型对用户是免攻击的任务，结合区块链以实现透明度，该项目向分布式学习系统的安全和隐私保护迈出了第一步。这一新方法的成功将显著影响FL在许多实际应用中的设计。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Researchers and the public have been alarmed by a fact that user privacy of training data in machine learning (ML) models has been exploited in many ways, leading to a rapidly expanding field of federated learning(FL). In FL, the learning of ML models is performed directly on user devices, while the aggregated model is composed with a help of a central server. As data never leave user devices, this new paradigm offers a key promise to protect data privacy. It, unfortunately, poses new challenges in both security and privacy. On one hand, malicious users can compromise security by injecting backdoors into the model updates, thus poisoning the aggregated model. On the other hand, there is a risk of privacy leakage as an untrusted server can inverse the model update to expose private data. This project develops a principled and systematic FL framework that simultaneously offers both privacy and security protection against threats from malicious users and servers. As part of this project, novel protocols will be developed to ensure verifiability, execution integrity, model confidentiality, and protection against adversarial attacks. The success of the project holds significant potential in expanding machine learning to new application scenarios, especially, when no trust is assumed among the stakeholders. The findings may also benefit other fields, such as zero-knowledge proof, distributed machine learning, and distributed ledger technology. The project involves students at all levels, with an emphasis on attracting students from underrepresented groups and K-12 students.The focus of the project is to develop a principled and systematic FL framework with three jointly key components: 1) a lightweight secure aggregation and backdoor inspection mechanisms in which each user is responsible for both securely aggregating their values and an attestation of an attack-free model, 2) a succinct non-interactive argument of knowledge (SNARK) attestation that minimizes non-arithmetic operations to maintain both high accuracy and communication-efficiency, and 3) a blockchain-based FL architecture to tight together security measures at various stages in the training process, offering privacy and security protection for the entire training process. By shifting a task of proving that model is free-of-attack to users, coupling of Blockchain for transparency, this project provides a first step towards a secured and privacy protection of distributed learning systems. The success of this novel approach will significantly impact the design of FL for many real-life applications.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.