Search papers, labs, and topics across Lattice.
This paper introduces a dual obfuscation method for federated learning that enhances privacy by jointly obfuscating gradients and training images, addressing vulnerabilities where training data can be reconstructed from model updates. The approach utilizes random binary weights to obscure gradient information and an image encryption technique that employs independent keys for each client and image, thereby mitigating the risk of data leakage. Experimental results indicate that this method significantly reduces the visual information recoverable through Attention Privacy Leakage (APRIL) while maintaining classification performance comparable to standard image encryption techniques.
Combining gradient obfuscation with image encryption can drastically reduce data leakage risks in federated learning without sacrificing model accuracy.
Federated learning enables collaborative model training while keeping data locally at each client; however, recent studies have shown that training data can be reconstructed from shared model updates. To address this issue, this paper proposes a dual obfuscation method that enhances robustness against image restoration attacks by jointly obfuscating updated information and training images. The proposed method combines a robustness enhancement technique based on random binary weights, which randomly sets a portion of gradient elements to zero, with an image encryption technique. These techniques provide complementary protection by reducing the amount of original gradient information available to an attacker and the visual interpretability of reconstructed images, respectively. Furthermore, the image encryption technique allows independent keys to be used for each client and each image, avoiding explicit key sharing. Experimental results on an image classification task using a Vision Transformer (ViT) show that the proposed method reduces the visual information recovered by Attention Privacy Leakage (APRIL) under the evaluated settings without causing additional degradation in classification performance beyond that caused by image encryption. Although the proposed combination does not provide an absolute security guarantee, the results demonstrate the potential benefit of combining gradient modification and image encryption for privacy-enhanced federated learning.
