Research map / Federated learning and privacy / Privacy attacks and secure learning
PPIDSG: A Privacy-Preserving Image Distribution Sharing Scheme with GAN in Federated Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PPIDSG, a federated learning scheme that shares only GAN generator parameters (CycleGAN-style, trained on block-scrambled encrypted images) instead of classifier parameters, with a separately trained autoencoder feature extractor to preserve utility against label, membership and reconstruction attacks.
Problem
Federated learning leaks private data through uploaded classifier parameters, enabling label inference, membership inference and image reconstruction attacks, while existing defenses either sacrifice accuracy or fail against some attacks.
Approach
Replace classifier parameter sharing with sharing of a CycleGAN-style generator that learns the distribution of block-scrambled (encrypted) images, adding a classification loss to the generator and training a separate autoencoder feature extractor and local classifier so no trained classifier leaves the client.
Key results
- PPIDSG achieves 70.56% accuracy on CIFAR10 and 91.53% on SVHN, the highest among defenses (best baseline ATS 59.67% and 85.22%).
- Label inference attack reaches ~100% with Sigmoid and 80%+ with ReLU/LeakyReLU against ATS, EtC, DP and GC, showing classifier sharing leaks labels.
- On CIFAR10 the enhanced MIA with prediction vectors reaches 84.30% versus 51.92% for ML-Leaks, while PPIDSG-style defenses lower MIA success in part/all settings.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use PPIDSG instead of the strongest reported baseline, ATS | classification on MNIST test · MNIST test | classification accuracy: 98.96 -> 99.43 | Helped |
| use PPIDSG instead of the strongest reported baseline, ATS | classification on F-MNIST test · F-MNIST test | classification accuracy: 89.23 -> 91.60 | Helped |
| use PPIDSG instead of the strongest reported baseline, ATS | classification on CIFAR10 test · CIFAR10 test | classification accuracy: 59.67 -> 70.56 | Helped |
| use PPIDSG instead of the strongest reported baseline, ATS | classification on SVHN test · SVHN test | classification accuracy: 85.22 -> 91.53 | Helped |
| use prediction vectors with the enhanced two-model attack instead of ML-Leaks' single-model attack | CIFAR10 membership inference · CIFAR10 | MIA accuracy: 51.92 -> 84.30 | Helped |
| add semantic loss to the generator (ablation) | PPIDSG · CIFAR10 | classification accuracy: 69.19 -> 70.56 | Helped |
| add classification loss to the generator (ablation) | PPIDSG · CIFAR10 | classification accuracy: 10.88 -> 70.56 | Helped |
| add classification and semantic losses to the generator (ablation) | PPIDSG · CIFAR10 | classification accuracy: 10.00 -> 70.56 | Helped |
| use IR rather than the full encryption configuration (ablation) | PPIDSG encryption · CIFAR10 | classification accuracy: 70.56 -> 71.35 | Mixed |
| remove IS block shuffling (ablation) | PPIDSG encryption · CIFAR10 | classification accuracy: 70.56 -> 70.06 | Hurt |
| vary encryption transformation combinations (ablation) | PPIDSG encryption · CIFAR10 | classification accuracy: 70.56; 69.59; 70.70; 70.55; 68.99; 70.73; 70.09; 71.00 | Mixed |
| increase encryption algorithm complexity (ablation) | PPIDSG encryption · CIFAR10 | classification accuracy | Hurt |
Surprising findings
- Label inference attacks succeed at near 100% when Sigmoid is used, even under protection by existing defenses.
- Sharing only generator parameters and training the classifier locally achieves higher accuracy than the defenses that share classifiers.
Limitations
- Generated images contain blank areas causing abnormal pixel distributions, which the authors attribute to aggregation and the image loss.
- Generator initialization yields dissimilar outputs across runs, indicating instability; the paper notes model aggregation and stable training as future work.
- Per-epoch time is about 3 minutes on CIFAR10, slower than most baselines.
Experimental setup
Datasets: MNIST FMNIST CIFAR10 SVHN
Benchmarks: MNIST FMNIST CIFAR10 SVHN
Metrics: classification accuracy label inference attack accuracy membership inference precision/recall/F1 PSNR for reconstruction attack
Baselines: ATS EtC DP GC FedCG ML-Leaks
Builds on: CycleGAN DeepEDN ML-Leaks DLG GradInversion
Closest papers by meaning
- Theoretically Unmasking Inference Attacks Against LDP-Protected Clients in Federated Vision Models (ICML 2025 · similarity 0.84)
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.84)
- Federated Learning via Input-Output Collaborative Distillation (AAAI 2024 · similarity 0.84)
- High-Fidelity Gradient Inversion in Distributed Learning (AAAI 2024 · similarity 0.83)
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.83)
- Leak and Learn: An Attacker's Cookbook to Train Using Leaked Data from Federated Learning (CVPR 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.