Shadow defense against gradient inversion attack in federated learning

TL;DR

This paper proposes a targeted shadow defense framework in federated learning that uses interpretability to identify sensitive image regions, enabling sample-specific noise injection to effectively prevent gradient inversion attacks while maintaining model accuracy.

Contribution

The novel framework leverages a shadow model for interpretability to identify vulnerable regions, allowing precise noise addition and improved privacy protection in federated learning.

Findings

Achieves significant PSNR and SSIM improvements against gradient inversion attacks.

Maintains less than 1% F1 accuracy reduction compared to state-of-the-art defenses.

Provides consistent defense enhancements across diverse medical imaging datasets.

Abstract

Federated learning (FL) has emerged as a transformative framework for privacy-preserving distributed training, allowing clients to collaboratively train a global model without sharing their local data. This is especially crucial in sensitive fields like healthcare, where protecting patient data is paramount. However, privacy leakage remains a critical challenge, as the communication of model updates can be exploited by potential adversaries. Gradient inversion attacks (GIAs), for instance, allow adversaries to approximate the gradients used for training and reconstruct training images, thus stealing patient privacy. Existing defense mechanisms obscure gradients, yet lack a nuanced understanding of which gradients or types of image information are most vulnerable to such attacks. These indiscriminate calibrated perturbations result in either excessive privacy protection degrading model accuracy, or insufficient one failing to safeguard sensitive information. Therefore, we introduce a framework that addresses these challenges by leveraging a shadow model with interpretability for identifying sensitive areas. This enables a more targeted and sample-specific noise injection. Specially, our defensive strategy achieves discrepancies of 3.73 in PSNR and 0.2 in SSIM compared to the circumstance without defense on the ChestXRay dataset, and 2.78 in PSNR and 0.166 in the EyePACS dataset. Moreover, it minimizes adverse effects on model performance, with less than 1\% F1 reduction compared to SOTA methods. Our extensive experiments, conducted across diverse types of medical images, validate the generalization of the proposed framework. The stable defense improvements for FedAvg are consistently over 1.5\% times in LPIPS and SSIM. It also offers a universal defense against various GIA types, especially for these sensitive areas in images.