用奇异值分解保护联邦学习中的梯度隐私,兼顾安全与模型性能。
SVDefense: Effective Defense against Gradient Inversion Attacks via Singular Value Decomposition
- 通过截断SVD对梯度进行混淆,隐藏敏感信息。
- 在图像分类等任务中,隐私保护强且模型准确率损失低于5%。
- 适合资源受限的嵌入式设备,防御策略可自适应应对攻击者。
联邦学习(FL)允许多方协作训练模型而无需共享原始数据,但易受梯度反演攻击(GIAs)威胁,攻击者可通过共享梯度重建私有数据。现有防御方法或计算开销过大,难以部署于嵌入式平台,或无法同时保障隐私与模型性能。此外,多数防御可被掌握防御细节的自适应攻击者轻易绕过。为此,本文提出SVDefense,一种基于截断奇异值分解(SVD)的新防御框架。该框架包含三项创新:自适应能量阈值,根据客户端脆弱性动态调整;通道加权近似,选择性保留关键梯度信息以支持训练并增强隐私;分层加权聚合,缓解类别不平衡带来的影响。大量实验表明,SVDefense在图像分类、人体活动识别和关键词检测等任务中均优于现有方法,在实现强隐私保护的同时,模型准确率下降不足5%。该方案适用于多种资源受限的嵌入式平台。代码将在论文录用后公开。
原文摘要 · Abstract (English)
Federated learning (FL) enables collaborative model training without sharing raw data but is vulnerable to gradient inversion attacks (GIAs), where adversaries reconstruct private data from shared gradients. Existing defenses either incur impractical computational overhead for embedded platforms or fail to achieve privacy protection and good model utility at the same time. Moreover, many defenses can be easily bypassed by adaptive adversaries who have obtained the defense details. To address these limitations, we propose SVDefense, a novel defense framework against GIAs that leverages the truncated Singular Value Decomposition (SVD) to obfuscate gradient updates. SVDefense introduces three key innovations, a Self-Adaptive Energy Threshold that adapts to client vulnerability, a Channel-Wise Weighted Approximation that selectively preserves essential gradient information for effective model training while enhancing privacy protection, and a Layer-Wise Weighted Aggregation for effective model aggregation under class imbalance. Our extensive evaluation shows that SVDefense outperforms existing defenses across multiple applications, including image classification, human activity recognition, and keyword spotting, by offering robust privacy protection with minimal impact on model accuracy. Furthermore, SVDefense is practical for deployment on various resource-constrained embedded platforms. We will make our code publicly available upon paper acceptance.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。