Research map / Federated learning and privacy / Differential privacy

Towards Trustworthy Federated Learning with Untrusted Participants

ICML 2025 · Federated learning and privacy › Differential privacy · approach: Differentially private federated learning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes CafCor, a robust and private federated/distributed SGD method where workers add pairwise-canceling correlated Gaussian noise from pairwise shared seeds plus a covariance-agnostic robust filter (CAF) at the server, achieving SecLDP privacy with utility approaching central DP.

Problem

Achieving both robustness to malicious workers and data privacy against an untrusted server in federated learning, where prior methods either need a trusted server or sacrifice utility under local DP.

Approach

Workers share pairwise secret seeds unknown to others and inject correlated Gaussian noise that cancels in aggregation (secret-based LDP), combined with a new robust aggregator CAF that does not need a bound on honest covariance, so privacy-utility trade-off approaches central DP when corruption is small.

Key results

• On MNIST and Fashion-MNIST with n=100 workers and f=5 malicious, CafCor under SecLDP matches the adversary-free DSGD under CDP (83% MNIST, 72% Fashion-MNIST).
• With f=10 malicious workers under ByzLDP, CafCor still significantly outperforms DSGD-LDP, which struggles to exceed 30% accuracy.
• In comparisons with robust aggregators under CDP, CAF achieves near adversary-free accuracy under label flipping (about 90%) on both datasets and best accuracy under sign flipping (near 80%).

Measured effects reported in the paper

Surprising findings

• Under SecLDP, a non-colluding malicious worker's secrets act as an independent noise source, so the independent server-side noise term can be removed entirely.

Limitations

• Privacy guarantee degrades when malicious workers collude with the server; utility gap to SecLDP vs CDP grows with f.
• Experiments limited to small MNIST/Fashion-MNIST CNN with 30 to 400 iterations.
• Assumes pairwise shared secrets via a PKI and honest-but-curious server; optimal SecLDP utility left open.

Experimental setup

Datasets: MNIST Fashion-MNIST

Benchmarks: MNIST Fashion-MNIST

Metrics: test accuracy privacy budget epsilon

Baselines: DSGD under LDP DSGD under CDP coordinate-wise trimmed mean coordinate-wise median geometric median Multi-Krum Meamed

Builds on: local differential privacy central differential privacy distributed SGD Filter algorithm for robust mean estimation ALIE attack

Closest papers by meaning

• Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.92)
• Private and Federated Stochastic Convex Optimization: Efficient Strategies for Centralized Systems (ICML 2024 · similarity 0.90)
• Noise-Aware Algorithm for Heterogeneous Differentially Private Federated Learning (ICML 2024 · similarity 0.90)
• Fortifying Federated Learning Towards Trustworthiness via Auditable Data Valuation and Verifiable Client Contribution (CVPR 2025 · similarity 0.89)
• Privacy-Preserving Federated Convex Optimization: Balancing Partial-Participation and Efficiency via Noise Cancellation (ICML 2025 · similarity 0.89)
• FedAA: A Reinforcement Learning Perspective on Adaptive Aggregation for Fair and Robust Federated Learning (AAAI 2025 · similarity 0.89)