Federated learning method protects model privacy and integrity from untrusted servers
EIFL: Efficiently Protecting Global Model Privacy and Integrity Against an Untrusted Server in Federated Learning
Cryptography and Security
Summary
Federated learning lets many people train a shared AI model without sending their data to one place, but it usually relies on a central server to combine everyone’s work. This server could cheat by changing the combined model, or might see sensitive details it shouldn't. The authors present EIFL, a way to keep the combined model secret from the server and verify it hasn’t been tampered with. EIFL avoids some common problems of earlier methods and works even if some participants drop out during verification.
What this means in practice
- •For enterprise ai teams: Ensure the privacy and correctness of aggregated AI models when the cloud server cannot be fully trusted.
- •For cloud service architects: Design federated learning platforms that protect against server tampering while reducing verification overhead and handling client dropouts.
Authors
Zehui Liao, Qiang Li, Binghui Wang
Abstract
Federated learning (FL) typically adopts a server-client architecture, where the server aggregates clients' local models (i.e., the input) and returns the aggregated global model (i.e., the output) to clients. An untrusted server may return a tampered global model to compromise the output integrity. Some existing schemes focus on verifying the output integrity. However, these schemes mostly rely on clients pre-negotiating a set of identical auxiliary information among themselves and keeping it confidential from the server. This dependency creates a verification vulnerability: if the auxiliary information is leaked, the verification method may be circumvented. Additionally, in some privacy-sensitive scenarios (e.g., commercial federated learning), the global model may need to be kept confidential from an untrusted server. However, only a few works achieve the output privacy while addressing verification vulnerability, at the cost of prohibitive computation and communication overhead. To address these challenges simultaneously, we propose a novel provably privacy-preserving FL method called EIFL. Specifically, we adopt a two-stage aggregation and combine it with symmetric encryption to protect the output privacy. To address the verification vulnerability, we propose an efficient verification method based on vector inner product for output integrity, and a random vector generation method for clients to agree on auxiliary information. EIFL innovatively binds the auxiliary information to the output integrity, and eliminates the need to keep the auxiliary information confidential from the server. Moreover, EIFL is robust against client dropout during the verification phase through a simple resending operation. Evaluation results validate the advantages of EIFL over state-of-the-art schemes in terms of computation and communication overhead.