TIP通过针对性扰动高频信息，在保护隐私的同时保持模型精度。
TIP: Resisting Gradient Inversion via Targeted Interpretable Perturbation in Federated Learning
- 基于梯度显著性识别关键卷积通道，仅对重要部分加扰。
- 在频域选择性注入扰动，使重建图像不可辨认但模型准确率不受损。
- 兼顾隐私与可解释性，适合注重安全的联邦学习应用。
联邦学习（FL）在保护数据本地性的同时实现协作训练，但梯度交换使其易受梯度反演攻击（GIA），攻击者可高保真重建私有训练数据。现有防御如差分隐私（DP）对所有参数统一加噪，严重损害模型性能和收敛稳定性。为此，我们提出目标可解释扰动（TIP），结合模型可解释性与频域分析。首先利用梯度加权类激活映射（Grad-CAM）量化通道敏感度，动态识别编码主要语义特征的关键卷积通道；其次将选定卷积核变换至频域，通过离散傅里叶变换（DFT）选择性地向高频谱注入校准扰动。该策略有效破坏图像重建所需的细粒度细节，同时保留对模型精度至关重要的低频信息。在基准数据集上的大量实验表明，TIP能有效使重构图像视觉上无法辨认，且全局模型准确率接近无隐私基线，显著优于现有基于DP的防御方法，在隐私-效用权衡与可解释性方面表现更优。代码已开源于 https://github.com/2766733506/asldkfjssdf_arxiv。
原文摘要 · Abstract (English)
Federated Learning (FL) facilitates collaborative model training while preserving data locality; however, the exchange of gradients renders the system vulnerable to Gradient Inversion Attacks (GIAs), allowing adversaries to reconstruct private training data with high fidelity. Existing defenses, such as Differential Privacy (DP), typically employ indiscriminate noise injection across all parameters, which severely degrades model utility and convergence stability. To address those limitation, we proposes Targeted Interpretable Perturbation (TIP), a novel defense framework that integrates model interpretability with frequency domain analysis. Unlike conventional methods that treat parameters uniformly, TIP introduces a dual-targeting strategy. First, leveraging Gradient-weighted Class Activation Mapping (Grad-CAM) to quantify channel sensitivity, we dynamically identify critical convolution channels that encode primary semantic features. Second, we transform these selected kernels into the frequency domain via the Discrete Fourier Transform and selectively inject calibrated perturbations into the high-frequency spectrum. By selectively perturbing high-frequency components, TIP effectively destroys the fine-grained details necessary for image reconstruction while preserving the low-frequency information crucial for model accuracy. Extensive experiments on benchmark datasets demonstrate that TIP renders reconstructed images visually unrecognizable against state-of-the-art GIAs, while maintaining global model accuracy comparable to non-private baselines, significantly outperforming existing DP-based defenses in the privacy-utility trade-off and interpretability. Code is available in https://github.com/2766733506/asldkfjssdf_arxiv
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。