A Personalized Privacy Preserving Mechanism for Crowdsourced Federated Learning

Privacy-preserving Federated Learning (FL) based on Differential Privacy (DP) protects clients’ data by adding DP noise to samples’ gradients and has emerged as a de facto standard for data privacy in FL. However, the accuracy of global models in DP-based FL may be reduced significantly when rogue clients occur who deviate from the preset DP-based FL approaches and selfishly inject excessive DP noise beyond expectations, thereby applying a smaller privacy budget in the DP mechanism to ensure a higher level of security. Existing DP-based FL fails to prevent such attacks as they are imperceptible. Under the DP-based FL system and random Gaussian noise, the local model parameters of the rogue clients and the honest clients have identical distributions. In particular, the rogue local models show a low performance, but directly filtering out lower-performance local models compromises the generalizability of global models, as local models trained on scarce data also behave with low performance in the early epoch. In this paper, we propose ReFL, a novel privacy-preserving FL system that enforces DP and avoids the accuracy reduction of global models caused by excessive DP noise of rogue clients. Based on the observation that rogue local models with excessive DP noise and honest local models trained on scarce data have different performance patterns in long-term training epochs, we propose a long-term contribution incentives scheme to evaluate clients’ reputations and identify rogue clients. Furthermore, we design a reputation-based aggregation to avoid the damage of rogue clients’ models on the global model accuracy, based on the incentive reputation. Extensive experiments demonstrate ReFL guarantees the global model accuracy performance 0.77% - 81.71% higher than existing DP-based FL methods in the presence of rogue clients.

Federated learning (FL) is a newly emerging distributed machine learning paradigm, whereby a server can coordinate multiple clients to jointly train a learning model by using their private datasets. Many researches focus on designing incentive mechanisms in FL, but most of them cannot allow that clients flexibly determine privacy budgets by themselves. In this article, we propose a privacy-preserving incentive mechanism (NICE) based on differential privacy (DP) and Stackelberg game for FL systems in industrial Internet of Things. First, we design a flexible privacy-preserving mechanism for NICE, in which clients can add a Laplace noise into the loss function according to a customized privacy budget. Under this mechanism, we design two incentive utility functions for the server and clients. Next, we model the utility optimization problems as a two-stage Stackelberg game by seeing the server as a leader and the clients as followers. Finally, we derive an optimal Stackelberg equilibrium solution for both the stages of the whole game. Based on this solution, NICE can make the server and all clients achieve their maximum utilities simultaneously. In addition, we conduct extensive simulations on real-world datasets to demonstrate the significant performance of the proposed mechanism.

Decentralized IoT data sharing: A blockchain-based federated learning approach with joint optimizations for efficiency and privacy

Federated learning (FL), which enables multiple distributed devices (clients) to collaboratively train a global model without transmitting their private data, has attracted much attention in the Internet of Things (IoT) domain. Compared with centralized learning, FL has obvious privacy advantages because it can protect the clients’ raw data from direct access by adversaries. Furthermore, to prevent the adversaries from inferring private information from the transmitted parameters, several FL algorithms based on differential privacy (DP) have been proposed, where the clients add artificial noise to their local parameters for privacy protection. Nevertheless, the added noise would disrupt the learning process and degrade the performance of the trained model. Considering this, in this article, we develop a performance-enhanced DP-based FL (PEDPFL) algorithm, where a classifier-perturbation regularization method is proposed to improve the robustness of the trained model against DP-injected noise. We derive the theoretical privacy and convergence analysis of the proposed algorithm, and also demonstrate the influence of some hyperparameters on the convergence performance. Simulation results on real-world data sets show that the proposed algorithm has better classification performance than the existing DP-based FL algorithms at the same level of privacy protection, and thus, it is more applicable to IoT applications.

Federated learning (FL), a cooperative distributed learning framework, has been employed in various intelligent Internet of Things (IoT) applications (e.g., smart health-care, smart home, and smart industry). However, there may be malicious devices in these IoT applications inferring other devices’ privacy or destroying the uploaded model parameters. Besides, due to the heterogeneity of IoT devices, it is difficult for the existing synchronized FL to effectively train models through non-identical independently distributed (non-IID) local data sets. To address these issues, we propose an asynchronous grouped federated learning framework (PAG-FL) for IoT, enabling multiple devices and the server to collaboratively and efficiently train models without revealing privacy. PAG-FL framework consists of an adaptive Rényi Differential Privacy-based privacy budget allocation (ARB) protocol and an asynchronous weight-based grouped update (AWGU) algorithm. In particular, our ARB protocol applies Rényi Differential Privacy and adaptively adjusts the privacy budget to obtain an efficient local model. The AWGU algorithm can defend against the poisoning attack on non-IID data set by weighing grouped local models to generate a global model. Meanwhile, it also realizes the asynchronous optimized update by adopting a lazy loading strategy. Theoretically, the proposed framework has a convergence guarantee and a privacy guarantee when training over the non-IID data set in an asynchronous FL. Our empirical experiments validate the effectiveness of the theoretical design and demonstrate the improved utility and robustness of PAG-FL in heterogeneous IoT.

Federated learning (FL) is currently the most widely adopted framework for collaborative training of (deep) machine learning models under privacy constraints. Albeit its popularity, it has been observed that FL yields suboptimal results if the local clients' data distributions diverge. To address this issue, we present clustered FL (CFL), a novel federated multitask learning (FMTL) framework, which exploits geometric properties of the FL loss surface to group the client population into clusters with jointly trainable data distributions. In contrast to existing FMTL approaches, CFL does not require any modifications to the FL communication protocol to be made, is applicable to general nonconvex objectives (in particular, deep neural networks), does not require the number of clusters to be known a priori, and comes with strong mathematical guarantees on the clustering quality. CFL is flexible enough to handle client populations that vary over time and can be implemented in a privacy-preserving way. As clustering is only performed after FL has converged to a stationary point, CFL can be viewed as a postprocessing method that will always achieve greater or equal performance than conventional FL by allowing clients to arrive at more specialized models. We verify our theoretical analysis in experiments with deep convolutional and recurrent neural networks on commonly used FL data sets.

Federated learning (FL) is vulnerable to gradient-based privacy attacks, where malicious attackers reconstruct training data from exchanged gradients. While existing differential privacy (DP) defenses mitigate this, they often cause excessive additive noise due to the inequality scaling in the theoretical analyses, which degrades the model's utility or fail under adaptive attacks. To address this issue, we propose <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">FedMSBA</b>, a layer-wise privacy-preservation method that adaptively allocates privacy budgets via Rényi DP (RDP) and modified sensitivity. FedMSBA dynamically scales noise to model intricacies and adaptively choose the better applied DP mechanisms, which provides a tighter mathematical bound and finally prevents non-convergence while resisting reconstruction attacks. Experiments demonstrate superior privacy-utility trade-offs compared to state-of-the-art defenses. FedMSBA achieves an approximately 2% improvement in accuracy and a 5% enhancement in privacy preservation. Furthermore, FedMSBA's performance remains nearly unaffected by variations in the privacy budget <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\epsilon$</tex-math></inline-formula> and failure rate <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\delta$</tex-math></inline-formula>.

Federated learning (FL) is a promising machine learning paradigm that focuses on sending data to the client, then using the local unique data to train the local model. Only the model updates are sent back to be aggregated into a global model; this action can efficiently protect the data privacy and security. However, developing the FL model in the real world is still unreliable due to the problem that the real-world dataset always contains both desired in-distribution data and unexpected out-of-distribution (OOD) data. Current FL researchers typically use prefabricated artificial data sets to conduct a series of experiments and obtain positive results, yet most of these datasets are in-distribution data. In this work, we propose a light weight Client-Side OOD Filtering method tailored for real-world FL compatibility. This method integrates seamlessly with standard FL frameworks by adding a simple pre-processing step on the client side, without modifying server-side aggregation logic. The core design includes two key components: (1) A lightweight ID classifier that quantifies the alignment between local data and ID distribution with soft max probability. (2) An adaptive threshold mechanism that retains data with probability ≥ IID data for regional training and filters out low probability data.

IoT technology shortens the last mile to access various data around human’s life and promotes the data-driven intelligence. Meanwhile, it brings about several security problems. Federated learning (FL) is proposed as a privacy-preserving learning paradigm. However, existing works show that FL is vulnerable to adversarial attacks. Against these attacks, differential privacy (DP) is regarded as one of the effective defenses. However, the existing DP-enabled FL works largely neglect the heterogeneity of participants in terms of protecting privacy. In this paper, we propose an adaptive DP-enabled FL (ADPFL). We are motivated by the heterogeneity resulting from non-iid distributions and associate the different privacy budgets with participants’ important parameters. Then, we assign different Laplacian mechanisms with different participants to generate different noises that perturb the uploaded gradients. Finally, we produce an ADPFL framework. We conduct extensive experiments to verify the effectiveness of our ADPFL.

With the continuous development of vehicular ad hoc networks (VANET) security, using federated learning (FL) to deploy intrusion detection models in VANET has attracted considerable attention. Compared to conventional centralized learning, FL retains local training private data, thus protecting privacy. However, sensitive information about the training data can still be inferred from the shared model parameters in FL. Differential privacy (DP) is sophisticated technique to mitigate such attacks. A key challenge of implementing DP in FL is that non-selectively adding DP noise can adversely affect model accuracy, while having many perturbed parameters also increases privacy budget consumption and communication costs for detection models. To address this challenge, we propose FFIDS, a FL algorithm integrating model parameter pruning with differential privacy. It employs a parameter pruning technique based on the Fisher Information Matrix to reduce the privacy budget consumption per iteration while ensuring no accuracy loss. Specifically, FFIDS evaluates parameter importance and prunes unimportant parameters to generate compact sub-models, while recording the positions of parameters in each sub-model. This not only reduces model size to lower communication costs, but also maintains accuracy stability. DP noise is then added to the sub-models. By not perturbing unimportant parameters, more budget can be reserved to retain important parameters for more iterations. Finally, the server can promptly recover the sub-models using the parameter position information and complete aggregation. Extensive experiments on two public datasets and two F2MD simulation datasets have validated the utility and superior performance of the FFIDS algorithm.

Traditional federated learning (FL) protects privacy by exchanging model updates instead of raw data. However, when applied to continuous medical behavior data, existing methods face two major challenges. First, standard FL frameworks remain vulnerable to advanced privacy attacks such as membership inference and attribute inference, since model gradients may still reveal individual behavioral patterns or sensitive medical events. Second, most differential privacy (DP) mechanisms, such as Gaussian noise injection, focus on global model protection and fail to ensure user-level trajectory privacy across the entire training process. To address these limitations, this study proposes FedHealthGuard, a user-level trajectory differential privacy federated learning framework tailored for continuous medical behavior data. FedHealthGuard introduces a trajectory-centric privacy paradigm, treating each participant’s sequence of model updates throughout the training process as a private trajecto ry. Comprehensive evaluations on three real-world continuous medical datasets (MIMIC-III, PAMAP2, ECG-PTB) show that FedHealthGuard attains strong user-level trajectory privacy (ɛ< 2.0) while preserving predictive utility. These results confirm that FedHealthGuard effectively balances privacy protection strength and predictive utility. This study provides an essential technical foundation for building the next generation of trustworthy, privacy-compliant, and high-performance distributed AI systems.

HierFedPDP:Hierarchical federated learning with personalized differential privacy

The essential issues of data silos and user privacy leakage could be relaxed substantially by the development of the federated learning (FL) architecture. In a collaborative multi-user modeling situation, malicious attackers could still use user gradient information to infer the danger of user privacy. To mitigate the issue of privacy leakage, differential privacy (DP) mechanism is integrated into the federated learning framework to assess privacy loss and introduce noise to the local model parameters of users. In addition, in order to minimize information leakage and provide better noise rejection, Rényi differential privacy (RDP) is introduced as a privacy metric, which improves the balance between model privacy and utility. Owing to the unknown target model and limited communication cost resources, a client-based adaptive learning algorithm is developed in which each local model parameter is adaptively updated during local iterations to accelerate model convergence and avoid model overfitting. The experimental results reveal that the client-based adaptive federation learning model in this paper outperforms the classic model at a fixed communication cost, is more robust to noise resistance and variable hyperparameter settings, and provides more accurate privacy protection during transmission.

Federated learning (FL) enables data owners to train a global model with shared gradients while keeping private training data locally. However, recent research demonstrated that the adversary may infer private training data of clients from the exchanged local gradients, e.g., having deep leakage from gradients (DLGs). Many existing privacy-preserving approaches take usage of differential privacy (DP) to guarantee privacy. Nevertheless, the widely used privacy budget of DP (e.g., evenly distribution) leads to a sharp decline of model accuracy. To improve the model accuracy, some schemes only consider allocating the privacy budget to the fully connected layers. However, we reveal that the adversary may still reconstruct the private training data by adopting the DLG attack with the gradients of convolutional layers. In this article, we propose a fine-grained DP federated learning (DPFL) scheme, which guarantees privacy and remains high model performance simultaneously. Specifically, inspired by the methods that measure the importance of layers in deep learning, we propose a fine-grained method to allocate noise according to the importance value of layers in order to remain high model performance. Besides, we combine an active client selection strategy with DPFL and perform fine-tuning with a public data set on the server to further ensure the model performance. We evaluate DPFL under both independent and identically distributed (i.i.d) and non-i.i.d data settings to show that our method can achieve similar accuracy as the plain FL (e.g., FedAvg). We also demonstrate that our DPFL can resist the DLG attack to verify its privacy guarantee.

Differential privacy (DP) is introduced into many fields of AI to preserve privacy. However, introducing DP into AI models is extremely error-prone. To verify whether DP AI models can provide privacy guarantee (quantified by privacy budget) as these models claim, existing methods utilize attack methods to audit whether privacy budget of these models is the same as these models claim. To further improve precision of privacy budget auditing, we propose a brand new way to audit privacy budget, namely directly utilizing the parameters of DP AI models to audit privacy budget. In particular, our method utilizes statistical characteristics variance of the output distribution of DP mechanism to audit privacy budget of DP mechanism. DP AI models are regarded as data samples from output distribution of DP AI model training method and are utilized to approximate the variance of output distribution. The approximated variance is leveraged to estimate the variance of noise distribution of DP mechanism and through the relationship between noise variance and privacy budget, our method calculates the audited privacy budget through estimated noise variance. In addition, to reduce computation overhead, our method constructs parameter selection strategy to identify position whose parameter is suitable for privacy budget auditing. Comprehensive experiments are conducted to verify the effectiveness of our auditing method. Comparison results of five competitive auditing methods demonstrate that our method decreases MAE by 18.29% and decreases MSE by 23.17% on experiment datasets.