Algorithmes de préservation de la confidentialité pour l'apprentissage fédéré

Privacy-preserving algorithms for federated learning

• Auteur / Autrice : Ilias Driouich
• Direction : Frédéric Giroire
• Type : Projet de thèse
• Discipline(s) : Informatique
• Date : Inscription en doctorat le 31/12/2021
• Etablissement(s) : Université Côte d'Azur en cotutelle avec COATI
• Ecole(s) doctorale(s) : École doctorale Sciences et technologies de l'information et de la communication
• Partenaire(s) de recherche : Laboratoire : Combinatoire, Optimisation et Algorithmes pour les Télécommunications

Mots clés

Mots clés libres

Confidentialité

Apprentissage fédéré

Cross-silo

Apprentissage automatique

Privacy-preserving

Federated learning

Inter-silos

Machine learning

Résumé

L'apprentissage centralisé traditionnel sur les modèles d'intelligence artificielle est confronté à des défis d'efficacité et de protection de la confidentialité. En effet, de plus en plus fréquemment, les données sont générées par de multiples parties et la protection de la confidentialité des données des utilisateurs devient un enjeu majeur. L'apprentissage fédéré (AF) [McM17, Pet19, Li20] vise à entraîner un modèle global unique sur des ensembles de données naturellement décentralisés permettant à des clients d'apprendre sans divulguer leurs données. Cependant, le seul maintien des données localement ne fournit pas de garanties formelles de confidentialité à l'AF. De nombreuses attaques ont été conçues pour montrer la vulnérabilité de tels systèmes dans lesquelles un adversaire peut reconstruire des données privées (par ex. des images) [Zhu19, Zhao20, Geiping20], inférer l'appartenance d'une l'instance dans un ensemble de données [Melis19, Zari21] et reconstruire le modèle local de l'utilisateur [Xu21] en écoutant juste les messages échangés. Pour contrer ce type d'attaques, des algorithmes “différentiellement privés” [McM18, Bellet18] ont été proposés pour l'AF dans lesquels des bruits non biaisés sont introduits dans le processus d'apprentissage. Ces algorithmes garantissent, dans une certaine mesure, qu'un adversaire ne peut tirer aucune conclusion de l'observation des messages échangés (par exemple sur l'appartenance d'une instance) même dans le cas extrême où un utilisateur ne changerait qu'un seul échantillon d'entraînement entre deux mises à jour Par conséquent, la première tâche de la thèse sera de proposer de nouveaux algorithmes (randomisés) de préservation de la confidentialité qui vont au-delà de l'ajout de bruit pour l'AF et d'étudier la garantie de confidentialité de ces algorithmes. Ensuite, à partir de la littérature sur l'apprentissage multi-tâches [Evg04, Mau08, Smith17, Hu21] et les algorithmes robustes [Gup20, Pill19, Pra20], nous étudierons comment adapter les algorithmes proposés pour générer des modèles personnalisés, similaires à celui étudié dans [Bellet18] et proposer de nouveaux algorithmes pour filtrer les mises à jour malveillantes. Bibliographie [McM17] McMahan et al, Communication-Efficient Learning of Deep Networks from Decentralized Data, AISTATS 2017, pages 1273-1282 [Pet19] Kairouz Peter et al. Advances and open problems in federated learning. arXiv preprint arXiv:1912.04977, 2019 [Li20] Tian Li et al, Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, pages 50-60, 2020 [Zhu19] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Adv Neural Information Processing Systems, pages 14774–14784, 2019. [Zhao20] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients [Geiping20] Jonas Geiping, Hartmut Bauermeister, Hannah Dr ̈oge, and Michael Moeller. Inverting gradients–how easy is it to break privacy in federated learning? NIPS, 2020 [Melis19] Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 691–706. IEEE, 2019 [Zari21] O. Zari, C. Xu, G. Neglia, Efficient Passive Membership Inference Attack in Federated Learning, NeurIPS workshop on Privacy in Machine Learning (PriML), Dec 2021, Online. [Xu21] C. Xu, G. Neglia, What else is leaked when eavesdropping Federated Learning?, ACM CCS workshop on Privacy Preserving Machine Learning (PPML), selected contributed talk, Nov 2021 [McM18] McMahan et al, Learning differentially private recurrent language model, ICLR 2018 [Bellet18] Bellet et al, Personalized and Private Peer-to-Peer Machine Learning, AISTATS 2018 [Hyl20] Stephanie L. Hyland and Shruti Tople, An Empirical Study on the Intrinsic Privacy of Stochastic Gradient Descent, arXiv:1912.02919 [Xiao20] H. Xiao, S. Devadas, Randomness Beyond Noise: Differentially Private Optimization Improvement through Mixup, NeurIPS PPML workshop 2020. [Xiao21] H. Xiao, S. Devadas, Towards Understanding Practical Randomness Beyond Noise: Differential Privacy and Mixup [Evg04]Evgeniou, T. and Pontil, M. Regularized multi-task learning. In KDD 2004 [Mau08] Maurer, A. The Rademacher Complexity of Linear Transformation Classes. In COLT. [Smith17] V. Smith, C. Chiang, M. Sanjabi, A. Talwalkar, Federated Multi-Task Learning in Neural Information Processing Systems (NeurIPS), 2017 [Hu21] S. Hu, Z. Wu, V. Smith, Private Multi-Task Learning: Formulation and Applications to Federated Learning [Gup20] Nirupam Gupta, Shuo Liu, Nitin H. Vaidya, Byzantine Fault-Tolerant Distributed Machine Learning using D-SGD and Norm-Based Comparative Gradient Elimination (CGE) [Pill19] Krishna Pillutla, Sham M. Kakade, Zaid Harchaoui, Robust Aggregation for Federated Learning [Pra20] Saurav Prakash et al, Byzantine-Resilient Federated Learning with Heterogeneous Data Distribution

The traditional centralized training of artificial intelligence models is facing efficiency and privacy challenges as data are increasingly being generated by multiple parties and there is a growing concern for user privacy and data confidentiality. Federated learning (FL) [McM17, Pet19, Li20] offers naturally a certain level of privacy, as the raw data is kept locally by the users and never needs to be sent elsewhere. However, maintaining the data locally does not provide itself formal privacy guarantees. Many attacks are designed to show the vulnerability of such a federated learning system where the adversary can reconstruct private data points (e.g. images) [Zhu19, Zhao20, Geiping20], infer the membership of the data instance [Melis19, Zari21] and reconstruct the local model of the user [Xu21] just by eavesdropping the exchanged messages. Although these attacks originally target cross-device settings, they adapt as well to the cross-silo setting where users communicate only with their neighbors. As a result, differential private algorithms [McM18, Bellet18] are proposed for FL where unbiased noises are introduced to the training process. It ensures to a certain extent that even if the user changes just one training sample, the adversary should not observe a certain level of difference in the exchanged message and thus could not draw any conclusions. Therefore, attacks are less efficient [Jay19]. However, these noises would deteriorate the performance of the model. A recent work [Hyl20] shows empirically that the learning algorithm SGD itself (without adding noise) contains intrinsic randomness which has not been leveraged for privacy. In [Xiao20, Xiao21], authors give rigorous analysis showing that the privacy can be amplified by randomizing the “mixup” procedure in decentralized learning (cross-silo setting). This encourages the design for random learning algorithms to preserve privacy apart from adding the unbiased noises. Therefore, the first task for this PhD would be to propose new privacy-preserving (random) algorithms beyond noise for cross-silo federated learning. Then, based on the multi-task learning literature [Evg04, Mau08, Smith17, Hu21], we can investigate how to adapt our private algorithm to generate personalized models in a cross-silo setting, similar to the one studied in [Bellet18]. References [McM17] McMahan et al, Communication-Efficient Learning of Deep Networks from Decentralized Data, AISTATS 2017, pages 1273-1282 [Pet19] Kairouz Peter et al. Advances and open problems in federated learning. arXiv preprint arXiv:1912.04977, 2019 [Li20] Tian Li et al, Federated learning: Challenges, methods, and future directions. IEEE Signal Processing Magazine, pages 50-60, 2020 [Zhu19] Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients. In Adv Neural Information Processing Systems, pages 14774–14784, 2019. [Zhao20] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. idlg: Improved deep leakage from gradients [Geiping20] Jonas Geiping, Hartmut Bauermeister, Hannah Dr ̈oge, and Michael Moeller. Inverting gradients–how easy is it to break privacy in federated learning? NIPS, 2020 [Melis19] Luca Melis, Congzheng Song, Emiliano De Cristofaro, and Vitaly Shmatikov. Exploiting unintended feature leakage in collaborative learning. In 2019 IEEE Symposium on Security and Privacy (SP), pages 691–706. IEEE, 2019 [Zari21] O. Zari, C. Xu, G. Neglia, Efficient Passive Membership Inference Attack in Federated Learning, NeurIPS workshop on Privacy in Machine Learning (PriML), Dec 2021, Online. [Xu21] C. Xu, G. Neglia, What else is leaked when eavesdropping Federated Learning?, ACM CCS workshop on Privacy Preserving Machine Learning (PPML), selected contributed talk, Nov 2021 [McM18] McMahan et al, Learning differentially private recurrent language model, ICLR 2018 [Bellet18] Bellet et al, Personalized and Private Peer-to-Peer Machine Learning, AISTATS 2018 [Hyl20] Stephanie L. Hyland and Shruti Tople, An Empirical Study on the Intrinsic Privacy of Stochastic Gradient Descent, arXiv:1912.02919 [Xiao20] H. Xiao, S. Devadas, Randomness Beyond Noise: Differentially Private Optimization Improvement through Mixup, NeurIPS PPML workshop 2020. [Xiao21] H. Xiao, S. Devadas, Towards Understanding Practical Randomness Beyond Noise: Differential Privacy and Mixup [Evg04]Evgeniou, T. and Pontil, M. Regularized multi-task learning. In KDD 2004 [Mau08] Maurer, A. The Rademacher Complexity of Linear Transformation Classes. In COLT. [Smith17] V. Smith, C. Chiang, M. Sanjabi, A. Talwalkar, Federated Multi-Task Learning in Neural Information Processing Systems (NeurIPS), 2017 [Hu21] S. Hu, Z. Wu, V. Smith, Private Multi-Task Learning: Formulation and Applications to Federated Learning [Gup20] Nirupam Gupta, Shuo Liu, Nitin H. Vaidya, Byzantine Fault-Tolerant Distributed Machine Learning using D-SGD and Norm-Based Comparative Gradient Elimination (CGE) [Pill19] Krishna Pillutla, Sham M. Kakade, Zaid Harchaoui, Robust Aggregation for Federated Learning [Pra20] Saurav Prakash et al, Byzantine-Resilient Federated Learning with Heterogeneous Data Distribution