Collaborative Research: SaTC: EAGER: Trustworthy and Privacy-preserving Federated Learning

研究人员和公众对机器学习（ML）模型中训练数据的用户隐私被以多种方式利用这一事实感到震惊，导致联邦学习（FL）领域迅速扩大。在FL中，ML模型的学习直接在用户设备上执行，而聚合模型则在中央服务器的帮助下组成。由于数据永远不会离开用户设备，这种新模式为保护数据隐私提供了关键承诺。不幸的是，它在安全和隐私方面提出了新的挑战。一方面，恶意用户可以通过在模型更新中注入后门来危害安全性，从而毒化聚合模型。另一方面，存在隐私泄露的风险，因为不受信任的服务器可以反转模型更新以暴露隐私数据。该项目开发了一个原则性和系统性的FL框架，同时提供隐私和安全保护，以抵御恶意用户和服务器的威胁。作为该项目的一部分，将开发新的协议，以确保可验证性，执行完整性，模型机密性和对抗性攻击的保护。该项目的成功在将机器学习扩展到新的应用场景方面具有巨大的潜力，特别是在利益相关者之间没有信任的情况下。这些发现也可能有益于其他领域，如零知识证明、分布式机器学习和分布式账本技术。该项目涉及各个层次的学生，重点是吸引来自代表性不足的群体和K-12学生的学生。该项目的重点是制定一个有原则和系统的外语框架，其中包括三个共同的关键组成部分：1）轻量级安全聚合和后门检查机制，其中每个用户负责安全地聚合他们的值和无攻击模型的证明，2）简洁的非交互式知识论证（SNARK）证明，最大限度地减少非算术运算，以保持高准确性和通信效率，以及3）基于区块链的FL架构，在培训过程的各个阶段将安全措施紧密结合在一起，为整个培训过程提供隐私和安全保护。通过将证明模型不受攻击的任务转移给用户，结合区块链以实现透明度，该项目为分布式学习系统的安全和隐私保护迈出了第一步。这一新方法的成功将对FL的设计产生重大影响，使其成为许多实际应用的基础。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Researchers and the public have been alarmed by a fact that user privacy of training data in machine learning (ML) models has been exploited in many ways, leading to a rapidly expanding field of federated learning(FL). In FL, the learning of ML models is performed directly on user devices, while the aggregated model is composed with a help of a central server. As data never leave user devices, this new paradigm offers a key promise to protect data privacy. It, unfortunately, poses new challenges in both security and privacy. On one hand, malicious users can compromise security by injecting backdoors into the model updates, thus poisoning the aggregated model. On the other hand, there is a risk of privacy leakage as an untrusted server can inverse the model update to expose private data. This project develops a principled and systematic FL framework that simultaneously offers both privacy and security protection against threats from malicious users and servers. As part of this project, novel protocols will be developed to ensure verifiability, execution integrity, model confidentiality, and protection against adversarial attacks. The success of the project holds significant potential in expanding machine learning to new application scenarios, especially, when no trust is assumed among the stakeholders. The findings may also benefit other fields, such as zero-knowledge proof, distributed machine learning, and distributed ledger technology. The project involves students at all levels, with an emphasis on attracting students from underrepresented groups and K-12 students.The focus of the project is to develop a principled and systematic FL framework with three jointly key components: 1) a lightweight secure aggregation and backdoor inspection mechanisms in which each user is responsible for both securely aggregating their values and an attestation of an attack-free model, 2) a succinct non-interactive argument of knowledge (SNARK) attestation that minimizes non-arithmetic operations to maintain both high accuracy and communication-efficiency, and 3) a blockchain-based FL architecture to tight together security measures at various stages in the training process, offering privacy and security protection for the entire training process. By shifting a task of proving that model is free-of-attack to users, coupling of Blockchain for transparency, this project provides a first step towards a secured and privacy protection of distributed learning systems. The success of this novel approach will significantly impact the design of FL for many real-life applications.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.