Federated learning enhanced with encryption and privacy protections
Combining Homomorphic Encryption and Differential Privacy in Federated Learning for Model Inspection and Availability
Cryptography and Security
Summary
Federated learning lets many devices train a computer model together without sharing their private data directly. But this method alone doesn’t always fully protect that data. The authors combined two privacy tools—one that encrypts data during training and another that adds randomness during model checking—to keep data safer. They tested this on a handwriting dataset and found their approach made the model work better while keeping data more private. This could help keep sensitive information secure when training shared models.
What this means in practice
- •For mobile app developers: Enable training of personalized models on user devices with stronger privacy guarantees by combining encrypted training and privacy-aware model updates.
- •For healthcare data teams: Support collaborative training of predictive models on sensitive patient data across hospitals while reducing privacy risks and improving model accuracy.
Tested on one dataset.
Authors
Ceren Yıldırım, Kamer Kaya, Sinan Yıldırım, Erkay Savaş
Abstract
The increasing prevalence of decentralized data has led to a growing interest in federated learning, which enables collaborative model training without clients sharing their sensitive local data. However, FL alone does not sufficiently protect sensitive training data and is generally coupled with privacy-preserving techniques, such as differential privacy and homomorphic encryption. Although powerful, these techniques address separate concerns via different mechanisms, so relying on just one might prove insufficient or impractical for addressing challenges associated with federated learning. In this work, we propose a privacy-preserving federated learning framework that combines homomorphic encryption-based training with differential privacy-based model inspection and release. We adopt a Markov chain Monte Carlo-based Bayesian privacy estimation method to estimate the privacy of our proposed framework. Our results show that this method improves both model utility and estimated privacy over the baseline method that relies solely on differential privacy for training. In our experiments with the FEMNIST dataset, by the end of training, our method reaches a test loss of $1.09$, compared to $2.37$ for the differential privacy-only approach, while providing stronger estimated privacy protection, with the estimated posterior mean of the privacy parameter $ε$ of $4.32$, compared to $7.26$ for the differential privacy-only approach. We also show that intermittent model monitoring can preserve the encrypted training trajectory while, under our evaluated experimental setting, providing estimated privacy comparable to or stronger than the differential privacy-only approach.