Layer-wise Characterization of Latent Information Leakage in Federated Learning
arXiv:2010.08762
Abstract
Training deep neural networks via federated learning allows clients to share, instead of the original data, only the model trained on their data. Prior work has demonstrated that in practice a client's private information, unrelated to the main learning task, can be discovered from the model's gradients, which compromises the promised privacy protection. However, there is still no formal approach for quantifying the leakage of private information via the shared updated model or gradients. In this work, we analyze property inference attacks and define two metrics based on (i) an adaptation of the empirical -information, and (ii) a sensitivity analysis using Jacobian matrices allowing us to measure changes in the gradients with respect to latent information. We show the applicability of our proposed metrics in localizing private latent information in a layer-wise manner and in two settings where (i) we have or (ii) we do not have knowledge of the attackers' capabilities. We evaluate the proposed metrics for quantifying information leakage on three real-world datasets using three benchmark models.
9 pages, at ICLR workshop (Distributed and Private Machine Learning)
References in corpus (9)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- PyTorch: An Imperative Style, High-Performance Deep Learning Library
- Evaluation: from precision, recall and F-measure to ROC, informedness, markedness and correlation
- iDLG: Improved Deep Leakage from Gradients
- DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environments
- A Framework for Evaluating Gradient Leakage Attacks in Federated Learning
- Encode, Shuffle, Analyze Privacy Revisited: Formalizations and Empirical Evaluation
- A Theory of Usable Information Under Computational Constraints
- Element Level Differential Privacy: The Right Granularity of Privacy