Decentralized Federated Aggregation With TEEs for Privacy Leakage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing federated learning frameworks are vulnerable to privacy leakage and data reconstruction attacks due to the exchange of model updates, which contain sensitive information, and current solutions like differential privacy and cryptographic primitives are computationally expensive or decrease model accuracy.
Innovation Solution
A multi-layered defense strategy involving trustworthy aggregation through trusted execution environments (TEEs) with encrypted virtual machines and decentralized aggregation across multiple independent entities, combined with dynamic permutation of model updates, to protect against information leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If model updates are shared in federated learning communications, then collaborative training can be achieved, but privacy leakage and data reconstruction attacks occur
Solution Approach 1:
The patent divides the centralized aggregation server into multiple decentralized aggregation servers. Each server receives and processes only a portion of the model updates from participating parties, rather than all updates being funneled through a single central server. This segmentation prevents any single server from having access to the complete set of model updates, thereby mitigating the risk of privacy leakage while maintaining collaborative training functionality.
2Object-affected harmful factors
If differential privacy is applied by adding statistical noise to model updates, then privacy is preserved, but model accuracy significantly decreases
Solution Approach 1:
Instead of adding statistical noise to all model updates (which degrades accuracy), the patent segments the aggregation process across multiple servers. Each server processes a subset of updates without noise addition, preserving the precision of individual update contributions. The decentralized architecture inherently provides privacy protection through distribution, eliminating the need for accuracy-degrading noise addition.
3Object-affected harmful factors
If cryptographic primitives like Secure Multi-Party Computation or Homomorphic Encryption are used, then privacy is protected, but computational cost increases significantly
Solution Approach 1:
The patent employs segmentation of the aggregation function across multiple servers rather than applying computationally expensive cryptographic primitives to the entire aggregation process. This distributed approach reduces the computational burden on each individual server while maintaining privacy protection through architectural design, avoiding the high computational costs of SMC or HE.
4Productivity
If a central aggregation server is used to fuse model updates, then aggregation efficiency is high, but it becomes a single point of failure during attacks
Solution Approach 1:
The patent segments the single central aggregation server into multiple decentralized aggregation servers. Each server handles a portion of the aggregation workload, maintaining efficiency through parallel processing. Simultaneously, this segmentation eliminates the single point of failure vulnerability, as the system can tolerate the compromise or failure of individual servers while continuing to function through the remaining servers.
Solution Approach 2:
The patent changes the structural parameter of the aggregation system from a single centralized entity to multiple decentralized entities. This parameter change transforms the system's reliability characteristics, distributing both the computational load (maintaining efficiency) and the failure risk (improving robustness) across multiple independent servers.
Data Source
AI summary
Techniques for distributed federated learning leverage a multi-layered defense strategy to provide for reduced information leakage. In lieu of aggregating model updates centrally, an aggregation function is decentralized into multiple independent and functionally-equivalent execution entities, each running within its own trusted executed environment (TEE). The TEEs enable confidential and remote-attestable federated aggregation. Preferably, each aggregator entity runs within an encrypted virtual machine that support runtime in-memory encryption. Each party remotely authenticates the TEE before participating in the training. By using multiple decentralized aggregators, parties are enabled to partition their respective model updates at model-parameter granularity, and can map single weights to a specific aggregator entity. Parties also can dynamically shuffle fragmentary model updates at each training iteration to further obfuscate the information dispatched to each aggregator execution entity. This architectural prevents the aggregator from being a single point-of-failure, and serves to protect the model even if all aggregators are compromised.