Separation of Powers in Federated Learning
arXiv:2105.09400
Abstract
Federated Learning (FL) enables collaborative training among mutually distrusting parties. Model updates, rather than training data, are concentrated and fused in a central aggregation server. A key security challenge in FL is that an untrustworthy or compromised aggregation process might lead to unforeseeable information leakage. This challenge is especially acute due to recently demonstrated attacks that have reconstructed large fractions of training data from ostensibly "sanitized" model updates. In this paper, we introduce TRUDA, a new cross-silo FL system, employing a trustworthy and decentralized aggregation architecture to break down information concentration with regard to a single aggregator. Based on the unique computational properties of model-fusion algorithms, all exchanged model updates in TRUDA are disassembled at the parameter-granularity and re-stitched to random partitions designated for multiple TEE-protected aggregators. Thus, each aggregator only has a fragmentary and shuffled view of model updates and is oblivious to the model architecture. Our new security mechanisms can fundamentally mitigate training reconstruction attacks, while still preserving the final accuracy of trained models and keeping performance overheads low.
References in corpus (18)
- Communication-Efficient Learning of Deep Networks from Decentralized Data
- Towards Federated Learning at Scale: System Design
- Differentially Private Federated Learning: A Client Level Perspective
- Private federated learning on vertically partitioned data via entity resolution and additively homomorphic encryption
- iDLG: Improved Deep Leakage from Gradients
- Protection Against Reconstruction and Its Applications in Private Federated Learning
- Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware
- Inverting Gradients -- How easy is it to break privacy in federated learning?
- Decentralized Stochastic Optimization and Gossip Algorithms with Compressed Communication
- Chiron: Privacy-preserving Machine Learning as a Service
- Peer-to-peer Federated Learning on Graphs
- IBM Federated Learning: an Enterprise Framework White Paper V0.1
- Efficient Deep Learning on Multi-Source Private Data
- SEVurity: No Security Without Integrity -- Breaking Integrity-Free Memory Encryption with Minimal Assumptions
- PPFL: Privacy-preserving Federated Learning with Trusted Execution Environments
- See through Gradients: Image Batch Recovery via GradInversion
- Confidential Inference via Ternary Model Partitioning
- CROSSLINE: Breaking "Security-by-Crash" based Memory Isolation in AMD SEV