Research map / Federated learning and privacy / Privacy attacks and secure learning
Revamping Federated Learning Security from a Defender's Perspective: A Unified Defense with Homomorphic Encrypted Data Space
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Federated Cryptography Defense (FCD), which applies a row-wise transposition cipher with a shared secret key to move FL training and testing into an encrypted data space, plus a KL-based self-distillation loss, to defend against both evasion data poisoning (M-SimBA) and model inversion attacks.
Problem
Federated learning is vulnerable to utility attacks (black-box evasion data poisoning at inference) and privacy attacks (model inversion), and existing defenses usually address only one of them.
Approach
Encrypt all data with a row-wise transposition cipher keyed by a shared secret, train clients on encrypted data with a loss combining cross-entropy and a KL distillation term from a local teacher trained on normal data, and let the server test on encrypted data without decryption, so attacks crafted in the original space are mismatched with the model's input space.
Key results
- Under M-SimBA evasion at 30% attack on GTSRB (Hom, 25 clients), FCD yields a utility impact of about 6.6 vs 13.0 for FAT and 8.9 for RS (reported in Table 4 as lower-is-better).
- On CIFAR100 model inversion in split FL, FCD reaches MSE 73.23 versus 0.05 for the next best defense ResSFL.
- Benign accuracy on GTSRB (Hom) improves to 97.72% for FCD vs 96.35% for no defense, while CIFAR10 accuracy drops slightly (77.28% vs 82.14%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use FCD encrypted-space training and evaluation instead of no-defense FL | Federated learning · GTSRB and KBTS, homogeneous and heterogeneous FL, no attack | global test accuracy: 96.35±0.02 -> 97.72±0.43; 94.98±0.06 -> 96.68±0.18; 98.30±0.80 -> 97.43±0.12; 97.10±0.62 -> 96.80±0.46 | Mixed |
| Use FCD encrypted-space training and evaluation instead of no-defense FL | Federated learning · CIFAR10 and EMNIST, homogeneous and heterogeneous FL, no attack | global test accuracy: 82.14±1.15 -> 77.28±1.77; 81.54±1.64 -> 76.16±0.19; 89.26±2.12 -> 85.56±2.12; 88.34±1.34 -> 83.16±2.08 | Hurt |
| Use FCD instead of FAT or RS | Federated learning · GTSRB and KBTS under M-SimBA evasion attacks | impact on utility (U): FCD consistently demonstrates superior performance and robustness across all attack percentages. | Helped |
| Use FCD instead of FAT or RS | Federated learning · CIFAR10 and EMNIST under M-SimBA evasion attacks | impact on utility (U): 10.81±0.49 vs 16.05±0.85; 10.44±0.23 vs 9.47±0.19 | Mixed |
| Train on FCD-encrypted data space | Federated learning on CIFAR100 · CIFAR100, model inversion attack | MSE: 0.05 -> 73.23 | Helped |
Surprising findings
- FCD's benign accuracy on CIFAR10 and EMNIST is slightly below no-defense FL, a trade-off the authors accept.
- Reconstructed images from model inversion on FCD resemble the encrypted data space rather than the original images, yielding very high MSE.
Limitations
- Vulnerable to adaptive key attacks and adaptive gradient attacks; multi-key encryption is proposed only as future defense.
- Slightly lower benign accuracy than vanilla FL on CIFAR10 and EMNIST.
- Utility impact increases with random selection of fewer client updates per round.
Experimental setup
Datasets: GTSRB KBTS CIFAR10 EMNIST CIFAR100
Benchmarks: GTSRB KBTS CIFAR10 EMNIST CIFAR100
Metrics: accuracy impact on utility (U) mean squared error (MSE)
Baselines: FAT Randomized Smoothing ResSFL Laplacian Dropout TopkPrune AdvNoise DistCorr Bottleneck Layers
Builds on: FedAvg knowledge distillation MSimBA ResSFL
Closest papers by meaning
- Dual Defense: Enhancing Privacy and Mitigating Poisoning Attacks in Federated Learning (NeurIPS 2024 · similarity 0.88)
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.87)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.87)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.86)
- FedMIA: An Effective Membership Inference Attack Exploiting "All for One" Principle in Federated Learning (CVPR 2025 · similarity 0.86)
- DictPFL: Efficient and Private Federated Learning on Encrypted Gradients (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.