Defense Against Gradient Leakage Attacks via Learning to Obscure Data

Abstract

Federated learning is considered as an effective privacy-preserving learning mechanism that separates the client's data and model training process. However, federated learning is still under the risk of privacy leakage because of the existence of attackers who deliberately conduct gradient leakage attacks to reconstruct the client data. Recently, popular strategies such as gradient perturbation and input encryption have been proposed to defend against gradient leakage attacks. Nevertheless, these defenses can either greatly sacrifice the model performance, or be evaded by more advanced attacks. In this paper, we propose a new defense method to protect the privacy of clients' data by learning to obscure data. Our defense method can generate synthetic samples that are totally distinct from the original samples, but they can also maximally preserve their predictive features and guarantee the model performance. Furthermore, our defense strategy makes the gradient leakage attack and its variants extremely difficult to reconstruct the client data. Through extensive experiments, we show that our proposed defense method obtains better privacy protection while preserving high accuracy compared with state-of-the-art methods.Recently, federated learning [22,18,3,13] has been considered as an efficient and effective privacypreserving machine learning framework, which has greatly relieved people's concern about privacy leakage. In federated learning, the clients can keep their private data in their local devices without sharing their data with other parties. They only need to train the model in their local devices and share the model update or gradient with a central server. The server aggregates these updates to construct a Preprint. Under review.