Over-the-Air Federated Learning with Privacy Protection via Correlated Additive Perturbations

TL;DR

This paper proposes a novel privacy-preserving method for wireless federated learning using correlated additive perturbations in over-the-air transmission, balancing privacy protection and model accuracy.

Contribution

It introduces a correlated perturbation scheme that minimizes privacy leakage and accuracy degradation simultaneously in over-the-air federated learning.

Findings

Correlated perturbations effectively protect privacy against eavesdroppers.

The method maintains high model accuracy compared to traditional perturbation techniques.

Theoretical analysis confirms the balance between privacy and convergence performance.

Abstract

In this paper, we consider privacy aspects of wireless federated learning (FL) with Over-the-Air (OtA) transmission of gradient updates from multiple users/agents to an edge server. By exploiting the waveform superposition property of multiple access channels, OtA FL enables the users to transmit their updates simultaneously with linear processing techniques, which improves resource efficiency. However, this setting is vulnerable to privacy leakage since an adversary node can hear directly the uncoded message. Traditional perturbation-based methods provide privacy protection while sacrificing the training accuracy due to the reduced signal-to-noise ratio. In this work, we aim at minimizing privacy leakage to the adversary and the degradation of model accuracy at the edge server at the same time. More explicitly, spatially correlated perturbations are added to the gradient vectors at the users before transmission. Using the zero-sum property of the correlated perturbations, the side effect of the added perturbation on the aggregated gradients at the edge server can be minimized. In the meanwhile, the added perturbation will not be canceled out at the adversary, which prevents privacy leakage. Theoretical analysis of the perturbation covariance matrix, differential privacy, and model convergence is provided, based on which an optimization problem is formulated to jointly design the covariance matrix and the power scaling factor to balance between privacy protection and convergence performance. Simulation results validate the correlated perturbation approach can provide strong defense ability while guaranteeing high learning accuracy.