Research map / Federated learning and privacy / Privacy attacks and secure learning
DictPFL: Efficient and Private Federated Learning on Encrypted Gradients
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DictPFL, which decomposes weights into a frozen local dictionary plus an encrypted lookup table and prunes lookup-table gradients with history-guided masks, so all transmitted gradients are CKKS-encrypted at much lower cost.
Problem
HE-based federated learning is expensive in communication and computation, and existing selective-encryption methods (FedML-HE) leave some gradients in plaintext, leaking private information to gradient inversion attacks.
Approach
Decompose-for-Partial-Encrypt (DePE) represents each weight as a static shared dictionary D plus a trainable lookup table T (W = W0 + D·T) so only T is encrypted and aggregated; Prune-for-Minimum-Encrypt (PrME) uses shared global-gradient history (Temporal Inactivity Pruning and Holistic Reactivation Correction) to prune T's gradients consistently across clients without encrypted index alignment.
Key results
- Reduces communication 402-748x and speeds training 28-65x versus fully encrypted FedHE-Full, and 51-155x / 4-19x versus FedML-HE.
- On ViT, DictPFL achieves 82.7% on Diabetic Retinopathy versus 82.74% for FedHE-Full with r=4 dictionary.
- Runtime within 2x of plaintext FL according to the abstract.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use DictPFL instead of FedHE-FULL | ViT-16 · GTSRB, 3-client homogeneous | accuracy: 58.9% -> 95.27% | Helped |
| use DictPFL instead of FedHE-FULL | federated learning without pre-trained weights · Without pre-trained weights | communication (GB): 720.72 -> 0.51 | Helped |
| use DictPFL instead of FedHE-FULL | federated learning without pre-trained weights · Without pre-trained weights | training time (min): 294.6 -> 11.8 | Helped |
| set dictionary size r to 8 instead of r=2 (ablation) | DictPFL DePE · Diabetic Retinopathy, 3-client homogeneous | accuracy (%): 74.26$_{\pm 0.5}$ -> 82.67$_{\pm 0.2}$ | Helped |
| set dictionary size r to 16 instead of r=8 (ablation) | DictPFL DePE · Diabetic Retinopathy, 3-client homogeneous | communication (GB): 0.160 -> 0.332 | Hurt |
| set pruning patience τ to 3 instead of τ=1 (ablation) | DictPFL PrME · Diabetic Retinopathy, 3-client homogeneous | accuracy (%): 80.55$_{\pm 0.6}$ -> 82.29$_{\pm 0.3}$ | Helped |
| increase pruning patience from τ=3 to τ=10 (ablation) | DictPFL PrME · Diabetic Retinopathy, 3-client homogeneous | communication (GB): 0.003 -> 0.474 | Hurt |
| use reactivation scaler β=0.8 instead of β=0.2 (ablation) | DictPFL PrME · Diabetic Retinopathy, 3-client homogeneous | communication (GB): 0.003 -> 0.031 | Hurt |
| omit accumulated local gradients when reactivating pruned parameters (ablation) | DictPFL HRC · Diabetic Retinopathy, Dirichlet α=0.3 | accuracy (%): 79.62 -> 74.26 | Hurt |
| use DictPFL instead of FedHE-FULL | TinyLlama · MetaMathQA evaluated on GSM8K | accuracy (%): 45.86 -> 45.93 | No clear effect |
| use DictPFL instead of FedHE-Full | BERT · AG's News | accuracy (%): 91.38 -> 91.24 | No clear effect |
| combine DictPFL with AdaptiveBatchHE (ablation) | ViT · CIFAR-10, 3-client | communication (GB): 0.43 -> 0.0872 | Helped |
Surprising findings
- FedML-HE with only 30% of gradients unencrypted allowed gradient inversion reconstructions with up to 23% similarity, showing selective encryption leaks.
Limitations
- Uses a fixed shared dictionary, which may limit adaptability under highly heterogeneous clients.
- Evaluated mainly on transformer models and cross-silo settings; cross-device FL not studied.
- Accuracy drops somewhat under aggressive pruning (70%) without reactivation.
Experimental setup
Datasets: CIFAR-10 GTSRB Diabetic Retinopathy AG's News MetaMathQA
Benchmarks: CIFAR-10 GTSRB Diabetic Retinopathy AG's News GSM8K
Metrics: accuracy communication overhead (GB) training time (min) 1-LPIPS similarity for gradient inversion
Baselines: FedHE-Full FedHE-Top2 FedML-HE Secure Aggregation AdaptiveBatchHE
Builds on: FedML-HE SVD truncation FedAvg
Closest papers by meaning
- A New Federated Learning Framework Against Gradient Inversion Attacks (AAAI 2025 · similarity 0.88)
- Little Is Enough: Boosting Privacy by Sharing Only Hard Labels in Federated Semi-Supervised Learning (AAAI 2025 · similarity 0.87)
- Concealing Sensitive Samples against Gradient Leakage in Federated Learning (AAAI 2024 · similarity 0.87)
- Federated Learning via Input-Output Collaborative Distillation (AAAI 2024 · similarity 0.87)
- Towards the Robustness of Differentially Private Federated Learning (AAAI 2024 · similarity 0.86)
- Gradient Inversion Attacks on Parameter-Efficient Fine-Tuning (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.