Search papers, labs, and topics across Lattice.
The paper introduces Alt-FL, a federated learning framework that interleaves differential privacy (DP), homomorphic encryption (HE), and synthetic data generation across training rounds to balance privacy, quality, and efficiency. Alt-FL proposes three interleaving methods: Privacy Interleaving (PI), Synthetic Interleaving with DP (SI/DP), and Synthetic Interleaving with HE (SI/HE), each offering different trade-offs. Empirical evaluation against gradient-based reconstruction attacks on CIFAR-10 and Fashion-MNIST datasets demonstrates that PI achieves the best balance at high privacy levels, while DP-based methods are preferable at intermediate privacy levels.
Forget choosing between differential privacy and homomorphic encryption in federated learning – this round-based interleaving strategy dynamically combines them with synthetic data for tunable privacy-quality-efficiency trade-offs.
In federated learning (FL), balancing privacy protection, learning quality, and efficiency remains a challenge. Privacy protection mechanisms, such as Differential Privacy (DP), degrade learning quality, or, as in the case of Homomorphic Encryption (HE), incur substantial system overhead. To address this, we propose Alt-FL, a privacy-preserving FL framework that combines DP, HE, and synthetic data via a novel round-based interleaving strategy. Alt-FL introduces three new methods, Privacy Interleaving (PI), Synthetic Interleaving with DP (SI/DP), and Synthetic Interleaving with HE (SI/HE), that enable flexible quality-efficiency trade-offs while providing privacy protection. We systematically evaluate Alt-FL against representative reconstruction attacks, including Deep Leakage from Gradients, Inverting Gradients, When the Curious Abandon Honesty, and Robbing the Fed, using a LeNet-5 model on CIFAR-10 and Fashion-MNIST. To enable fair comparison between DP- and HE-based defenses, we introduce a new attacker-centric framework that compares empirical attack success rates across the three proposed interleaving methods. Our results show that, for the studied attacker model and dataset, PI achieves the most balanced trade-offs at high privacy protection levels, while DP-based methods are preferable at intermediate privacy requirements. We also discuss how such results can be the basis for selecting privacy-preserving FL methods under varying privacy and resource constraints.
