TAPFed: Threshold Secure Aggregation for Privacy-Preserving Federated Learning

TL;DR

TAPFed introduces a threshold functional encryption-based secure aggregation method for federated learning, enhancing privacy and robustness against malicious aggregators and inference attacks, while reducing communication overhead.

Contribution

It presents a novel threshold encryption scheme for federated learning that tolerates malicious actors and defends against inference attacks, with formal security analysis.

Findings

Achieves comparable model accuracy to state-of-the-art methods.

Reduces transmission overhead by 29%-45%.

Provides security against inference attacks from malicious aggregators.

Abstract

Federated learning is a computing paradigm that enhances privacy by enabling multiple parties to collaboratively train a machine learning model without revealing personal data. However, current research indicates that traditional federated learning platforms are unable to ensure privacy due to privacy leaks caused by the interchange of gradients. To achieve privacy-preserving federated learning, integrating secure aggregation mechanisms is essential. Unfortunately, existing solutions are vulnerable to recently demonstrated inference attacks such as the disaggregation attack. This paper proposes TAPFed, an approach for achieving privacy-preserving federated learning in the context of multiple decentralized aggregators with malicious actors. TAPFed uses a proposed threshold functional encryption scheme and allows for a certain number of malicious aggregators while maintaining security and privacy. We provide formal security and privacy analyses of TAPFed and compare it to various baselines through experimental evaluation. Our results show that TAPFed offers equivalent performance in terms of model quality compared to state-of-the-art approaches while reducing transmission overhead by 29%-45% across different model training scenarios. Most importantly, TAPFed can defend against recently demonstrated inference attacks caused by curious aggregators, which the majority of existing approaches are susceptible to.