将差分隐私与加密计算结合,提升联合学习的隐私安全性。
SoK: Enhancing Cryptographic Collaborative Learning with Differential Privacy
- 提出统一框架,聚焦安全噪声采样这一核心环节。
- 评估不同噪声方法在准确率和计算开销间的权衡。
- 适合关注隐私保护机器学习的科研人员与工程师。
在联合学习(CL)中,多方在不共享原始数据的前提下协同训练模型。为保障输入隐私,多端计算(MPC)等加密技术可对数据进行加密训练。然而,即使训练过程安全,模型输出仍可能遭受推理攻击,导致记忆数据泄露。为保障输出隐私,差分隐私(DP)在训练中注入校准噪声。尽管加密与差分隐私提供互补保护,但高效融合二者在加密与差分隐私联合学习(CPCL)中面临挑战:加密带来性能开销,而差分隐私降低准确率,形成隐私-准确率-性能的权衡。本文系统化梳理了CPCL研究现状,提出统一框架以概括各类范式共性,识别安全噪声采样为实现CPCL的基础步骤。分析不同安全噪声采样技术、噪声类型及差分隐私机制的实现难点,评估其在各类CPCL范式中的准确率与加密开销。进一步在MPC中实现多种噪声采样方案,评估其在广域网(WAN)与局域网(LAN)下的计算与通信成本。最后基于关键发现,提出未来研究方向。
原文摘要 · Abstract (English)
In collaborative learning (CL), multiple parties jointly train a machine learning model on their private datasets. However, data can not be shared directly due to privacy concerns. To ensure input confidentiality, cryptographic techniques, e.g., multi-party computation (MPC), enable training on encrypted data. Yet, even securely trained models are vulnerable to inference attacks aiming to extract memorized data from model outputs. To ensure output privacy and mitigate inference attacks, differential privacy (DP) injects calibrated noise during training. While cryptography and DP offer complementary guarantees, combining them efficiently for cryptographic and differentially private CL (CPCL) is challenging. Cryptography incurs performance overheads, while DP degrades accuracy, creating a privacy-accuracy-performance trade-off that needs careful design considerations. This work systematizes the CPCL landscape. We introduce a unified framework that generalizes common phases across CPCL paradigms, and identify secure noise sampling as the foundational phase to achieve CPCL. We analyze trade-offs of different secure noise sampling techniques, noise types, and DP mechanisms discussing their implementation challenges and evaluating their accuracy and cryptographic overhead across CPCL paradigms. Additionally, we implement identified secure noise sampling options in MPC and evaluate their computation and communication costs in WAN and LAN. Finally, we propose future research directions based on identified key observations, gaps and possible enhancements in the literature.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。