A dual obfuscation method that enhances robustness against image restoration attacks by jointly obfuscating updated information and training images and allowing independent keys to be used for each client and each image, avoiding explicit key sharing is proposed.
Abstract
Federated learning enables collaborative model training while keeping data locally at each client; however, recent studies have shown that training data can be reconstructed from shared model updates. To address this issue, this paper proposes a dual obfuscation method that enhances robustness against image restoration attacks by jointly obfuscating updated information and training images. The proposed method combines a robustness enhancement technique based on random binary weights, which randomly sets a portion of gradient elements to zero, with an image encryption technique. These techniques provide complementary protection by reducing the amount of original gradient information available to an attacker and the visual interpretability of reconstructed images, respectively. Furthermore, the image encryption technique allows independent keys to be used for each client and each image, avoiding explicit key sharing. Experimental results on an image classification task using a Vision Transformer (ViT) show that the proposed method reduces the visual information recovered by Attention Privacy Leakage (APRIL) under the evaluated settings without causing additional degradation in classification performance beyond that caused by image encryption. Although the proposed combination does not provide an absolute security guarantee, the results demonstrate the potential benefit of combining gradient modification and image encryption for privacy-enhanced federated learning.
Experimental results indicate that TMI-VFL achieves an effective trade-off between privacy protection and model utility, providing a practical solution for secure VFL.
Yuqing Song· Poster Volume 0008 The 2026...· 0 citations
This article proposes a novel adaptive obfuscation mechanism, coined FedAdOb, to protect private data without yielding original model performances, and utilizes passport-based adaptive obfuscation to ensure data privacy in both horizontal and vertical federated learning settings.
Hanlin Gu, Jiahuan Luo, Yan Kang et al.· IEEE Transactions on Pattern...· 0 citations
Federated learning lets hospitals train shared diagnostic models without exchanging patient images, yet the updates they exchange each round can be inverted to reconstruct training images. Homomorphic encryption (HE) protects these updates, but encrypting an entire model with CKKS inflates communication and computation to impractical levels for cross-silo medical use. We present PASHE-FL, which exploits the structure of personalized federated learning: the client-specific classifier head stays local and is never uploaded, so encryption need only cover the shared backbone. The server ranks backbone coordinates by importance from the public global model and selects the same top-ρ set for all clients, avoiding mask negotiation; these are encrypted with CKKS, the remaining coordinates are quantized, and the encrypted fraction is annealed over training. On four medical image-classification tasks, PASHE-FL matches the personalized FedPer baseline within about one accuracy point while cutting per-round uplink by roughly 7.1–7.6× and encryption time by about 8× relative to full-model HE; this accuracy comes from personalization, not encryption. Under a gradient-inversion attack, encrypting only the top 5–10% most important coordinates collapses reconstruction quality, whereas encrypting random coordinates does not. PASHE-FL offers an empirical privacy–cost trade-off under the stated threat model rather than a formal privacy guarantee.
Zhaobin Li, Mingliang Mo, Chenchong Du et al.· Applied Informatics· 0 citations
Federated learning is a technology that is used to protect data privacy in machine learning. Nonetheless, in federated learning, updating the global model requires the use of gradient descent algorithm, which involves multiple rounds of interaction between entities to complete the iterative updates, inevitably incurring massive computational and communication overhead. In 2020, Wang et al. first proposed a non-interactive federated regression scheme, which effectively improves the training efficiency of regression models while protecting the privacy of local training data. However, like most current federated regressions, it involves a third authority (TA) to generate keys for each entity, which poses a significant privacy risk and results in considerable communication overhead. From the view of security and practicality, this paper first proposes a multi-party homomorphic encryption algorithm named MPaillier. Furthermore, we have designed PNFR, a privacy-preserving federated learning scheme for regressions training built on the MPaillier algorithm. The participating entities of PNFR are the data owners and a cloud server, eliminating the need for a TA, thus enhancing the practicality and efficiency of the scheme. Experimental results demonstrate that our scheme is $\sim 10^{3}$ times faster than interactive federated regressions PrivFL and about 80% faster than non-interactive federated regressions VANE.
Secure Federated Learning protects user privacy by keeping local gradients within the ciphertext space, thereby preventing direct exposure of raw gradients during aggregation. Paradoxically, this very protection introduces a fundamental vulnerability: the opacity of encrypted gradients blinds the server, rendering honest and malicious gradients indistinguishable. An attacker can exploit this opacity to inject manipulated gradients directly into the secure aggregation process, compromising the integrity of the global model. To address this issue, we propose SFLBR, a novel Byzantine-robust Secure Federated Learning framework. Specifically, we adopt the gradient median as a robust benchmark and introduce a layer-wise cosine similarity metric to differentiate malicious gradients. Furthermore, considering the complexity of non-independent and identically distributed (Non-IID) scenarios, we further design a proactive defense strategy that constrains the divergence among honest gradients, and augment it with a trust score function to improve robustness against potential misjudgments. Finally, we construct a series of secure communication protocols based on a lightweight dual-masking encryption mechanism, which enable efficient robust aggregation directly within the ciphertext space. Extensive experiments validate the effectiveness of SFLBR, demonstrating state-of-the-art (SOTA) defense performance across diverse attack scenarios.
Jinbo Wang, Ruijin Wang, Zengpeng Li et al.· IEEE Transactions on Informa...· 0 citations
Federated learning (FL) enables collaborative model training across multiple clients in a privacy-preserving manner. However, the employment of homomorphic encryption algorithms might lead to high computational cost while the application of differential privacy (DP) methods would sacrifice model performance. To establish efficient and secure FL system as well as maintaining competitive performance, we introduce a DP-enabled cascaded filter with novel model-aggregation mechanism. Taking the model parameters of one client for example, dimensions with large absolute values and significant variations are selected by the cascaded filter and regarded as important dimensions. After that, random noise are added to these important dimensions for data security. Finally, the model parameters will be sent to the central server for aggregation. Unlike traditional DP-based approaches, our method considers each dimension’s informational importance, i.e., both absolute value and its variation. We theoretically prove the convergence of our method and verify the effectiveness on different scenarios including four datasets. The experimental results suggest that our method outperforms the other ones from literature under both IID and non-IID conditions while achieving high level of efficiency and privacy protection performance.
Zhiqiang Chen, Yuchen Jiang, Ray Y. Zhong et al.· IEEE Transactions on Informa...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
