PRECAD: Privacy-Preserving and Robust Federated Learning via Crypto-Aided Differential Privacy
This work addresses the critical need for secure and reliable Federated Learning systems, offering a combined solution for privacy and robustness that is incremental over prior defenses focusing on only one aspect.
The paper tackles the problem of vulnerabilities in Federated Learning to attacks compromising data privacy and model robustness by developing PRECAD, a framework that simultaneously achieves differential privacy and enhances robustness against model poisoning attacks using cryptography, resulting in higher privacy-utility tradeoff and improved robustness in trained models.
Federated Learning (FL) allows multiple participating clients to train machine learning models collaboratively by keeping their datasets local and only exchanging model updates. Existing FL protocol designs have been shown to be vulnerable to attacks that aim to compromise data privacy and/or model robustness. Recently proposed defenses focused on ensuring either privacy or robustness, but not both. In this paper, we develop a framework called PRECAD, which simultaneously achieves differential privacy (DP) and enhances robustness against model poisoning attacks with the help of cryptography. Using secure multi-party computation (MPC) techniques (e.g., secret sharing), noise is added to the model updates by the honest-but-curious server(s) (instead of each client) without revealing clients' inputs, which achieves the benefit of centralized DP in terms of providing a better privacy-utility tradeoff than local DP based solutions. Meanwhile, a crypto-aided secure validation protocol is designed to verify that the contribution of model update from each client is bounded without leaking privacy. We show analytically that the noise added to ensure DP also provides enhanced robustness against malicious model submissions. We experimentally demonstrate that our PRECAD framework achieves higher privacy-utility tradeoff and enhances robustness for the trained models.