Privacy-Preserving Federated Learning via Homomorphic Adversarial Networks

Authors: Wenhan Dong, Chao Lin, Xinlei He, Xinyi Huang, Shengmin Xu
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Federated Learning, Privacy Protection, Homomorphic Encryption, Homomorphic Adversarial Networks

Abstract:
Privacy-preserving federated learning (PPFL) aims to train a global model for multiple clients while maintaining their data privacy. However, current PPFL protocols exhibit one or more of the following insufficiencies: considerable degradation in accuracy, the requirement for sharing keys, and cooperation during the key generation or decryption processes. As a mitigation, we develop the first protocol that utilizes neural networks to preserve privacy in federated learning, as well as incorporating an Aggregatable Hybrid Encryption scheme tailored to the needs of the PPFL. We name these networks as Homomorphic Adversarial Networks (HANs) which demonstrate that neural networks are capable of performing tasks similar to multi-key homomorphic encryption (MK-HE) while solving the problems of key distribution and collaborative decryption. Our experiments show that HANs are robust against privacy attacks. Compared with non-private federated learning, experiments conducted on multiple datasets demonstrate that HANs exhibit a negligible accuracy loss (at most 1.35\%). Compared to traditional MK-HE schemes, HANs increase encryption aggregation speed by 6,075 times while incurring a 29.2-fold increase in communication overhead.

Decision: reject
Reviewer scores: 5, 3, 3, 5, 3, 3

Reviews and discussion:
<thread>
creation date:
1730303194727

thread_type:
official_review

<thread_object>
creator: reviewer_fbzb

<content>
summary:
The paper proposes an empirical solution leveraging GAN to address the privacy challenge during federated model aggregation.

strengths:
1. The paper focuses on one of the important privacy issues in federated learning. Aggregation data privacy has been a constant challenge, especially considering the tradeoffs among privacy, overhead, and performance.

2. The paper proposes an empirical solution using GAN for privacy protection.

weaknesses:
1. The paper misses a major related domain, which is threshold HE. Compared to MK-HE, threshold HE (1) in general does not incur additional overheads both in computation and ciphertext; (2) does not suffer from client dropout issues, which is a common challenge in practical FL systems.

2. There is no formal rigorous security proof, as the authors stated themselves in the paper. The informal discussion in Appendix G does not satisfy the requirement needed for the claimed privacy guarantee, I would like to see security proofs under, for example, UC-Security, but it seems like GAN-based solutions would fail to be assessed this way. Regarding the collusion models, the paper introduces pseudo N−1 collusion attacks, but it does not fully address the potential vulnerabilities in scenarios with more sophisticated collusion strategies or when attackers can coordinate over time. Additionally, per my understanding of the paper, the assumed security is bounded and realized by obfuscating the training of the GAN, what if the adversary can train a similar GAN? This approach largely relies on security through obscurity, which is generally regarded as an unreliable security approach. The privacy guarantee of this paper is far from being convincing and considered as a serious privacy/security work.


3. Even if the idea of using a GAN-like solution worked to satisfy the privacy guarantee, there would be limited novelty compared to the previous NN-based encryption systems referred in the related work, other than applying it in the federated learning setup.

4. In a lot of FL systems in practice, the communication limitation is more of a bottleneck compared to the aggregation computation overhead which is relatively easier to solve by scaling up the server. This communication overhead for the computation improvement approach might not solve the more practical challenges. 

5. It is hard to follow the paper, especially given the confusing structures of Section 1 and Section 3. In Section 1, it is unclear what the major research challenge this paper tries to tackle regarding MK-HE and the research contribution of this paper following that. In Section 3, the threat model could have been precisely captured and a structured description of the proposed method is missing. The majority of the technical details of the proposed HAN are in Appendix (e.g. PPU in Appendix E) while the main paper contains little information on how and why HAN would work in terms of performance and privacy.

questions:
1. Are all experiments a simulation of FL running on a single machine?
2. Why not consider more recent stronger attacks than DLG? 
3. Did the authors perform analysis on the proposed method when applied to LLMs?
4. What does "Primarily, they focus on symmetric encryption without addressing homomorphic computation." mean? Symmetric encryption and homomorphic encryption are not two mutually exclusive concepts.
5. Could you provide a more formal definition of AHE that complies with the standard security definition? Also, why does the $m_{agg}$ step only consider 3 ciphertexts?
6. The paper mentioned that CKKS-based implementation would have a huge accuracy drop. Could you show the experimental results supporting this claim? In the FL setting, CKKS's approximation error will generally not significantly impact the performance due to the relatively simple aggregation operations, compared to a full-on end-to-end encrypted NN.
7. Some of the experiments do not have error bars, for example, Table 5.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730532178173

thread_type:
official_review

<thread_object>
creator: reviewer_vyrp

<content>
summary:
The paper presents a novel approach to Privacy-Preserving Federated Learning (PPFL) by introducing Homomorphic Adversarial Networks (HANs). HANs utilize neural networks to emulate multi-key homomorphic encryption (MK-HE), addressing key distribution and collaborative decryption challenges. The proposed Aggregatable Hybrid Encryption (AHE) scheme is designed to balance computational efficiency, cryptographic security, and the distributed nature of FL systems. The paper claims that HANs exhibit robustness against privacy attacks with negligible accuracy loss and significantly improved encryption aggregation speed compared to traditional MK-HE schemes.

strengths:
1. Originality: The paper introduces Homomorphic Adversarial Networks (HANs), an innovative approach using neural networks for multi-key homomorphic encryption in federated learning, offering a new perspective on privacy preservation.
2. Quality: This study is of fair quality. It achieved a notable 6,075-fold acceleration in encryption aggregation with minimal loss in accuracy, showcasing the practicality and robustness of HANs against a variety of attacks.
3. Clarity: The paper is clearly written, with a well-structured presentation that effectively communicates the novelty of HANs and their advantages over existing methods.
4. Significance: The work is significant for advancing privacy in federated learning, particularly in resisting collusion attacks and maintaining model accuracy.

weaknesses:
1. The security of HANs is predicated on the presence of at least two honest clients, which may not always be feasible. The paper could be improved by discussing alternative security models that do not rely on this assumption or by exploring the implications of a higher number of malicious clients.
2. While the paper provides a general discussion on the security aspects of Homomorphic Adversarial Networks (HANs), the analysis lacks the rigor and formality expected in a comprehensive security evaluation. 
3. The paper's comparison with traditional MK-HE schemes is compelling, but a more comprehensive benchmark against a broader range of state-of-the-art PPFL methods would strengthen the paper's claims. 
4. The experiments only focus on a few datasets and models. To strengthen the paper's arguments, the authors should consider demonstrating the versatility of HANs across a broader range of datasets (e.g., text datasets) and various model architectures.
5. The paper mentioned the increase in communication overhead by HANs, but it indeed provided a detailed analysis, including performance under various network conditions.
6. The paper does not demonstrate the adaptability and effectiveness of the AHE method in various federated learning scenarios, especially in environments with significant variations in data sensitivity and attack surfaces, which limits a comprehensive understanding of the performance and security of the AHE scheme in practical applications.

questions:
1. The security of HANs relies on the presence of at least two honest clients. Can the authors discuss alternative security models that do not depend on this assumption, or explore the impact on HANs' security when the number of malicious clients increases?
2. The authors should provide more rigorous security proofs or mathematical models to support the security claims made in the paper.
3. Regarding the comparison with traditional MK-HE schemes, the authors should expand the comparison to include a broader range of PPFL methods.
4. To strengthen the arguments in the paper, the authors should consider demonstrating the diversity and applicability of HANs across a wider range of datasets and various model architectures.
5. Regarding the communication overhead issue of HANs, the authors can further discuss the impact of this increased communication overhead on practical deployment and consider whether it is possible to reduce these costs through optimization.
6. Regarding the adaptability and effectiveness of AHE, the authors can provide more experimental data or theoretical analysis on the performance and adaptability of AHE in different scenarios.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730616218154

thread_type:
official_review

<thread_object>
creator: reviewer_lv8n

<content>
summary:
The paper addresses the challenges of key sharing and collaboration in Privacy-Preserving Federated Learning (PPFL) protocols, which may lead to privacy risks and inconvenience. The authors propose a PPFL protocol implemented using neural networks, combined with an aggregatable hybrid encryption scheme. By accepting some trade-offs in communication overhead and accuracy, this approach significantly enhances the encryption aggregation speed.

strengths:
The proposed method in this paper significantly enhances encryption aggregation speed, which is often a key factor influencing the overall efficiency of federated learning (FL) systems. The approach of using neural networks as a substitute for the MK-HE algorithm introduces a novel perspective with meaningful research value. Additionally, this method is robust against various forms of collusion, ensuring the privacy of both the model and users.

weaknesses:
The paper contains a typographical error in the abstract’s first word, which reads “Privacy-peserving” instead of “Privacy-preserving”.

In the Introduction, the main technique of the paper (using neural networks to simulate MK-HE) is not clearly stated, instead appearing in the contributions section, which makes the structure feel somewhat unbalanced. Additionally, the flow of the introduction could be improved for better clarity. It is recommended to briefly introduce the neural network simulation technique within the Introduction to set up the main idea clearly, while streamlining the first part of the contributions section. Structuring the Introduction by first presenting the problem context, followed by current challenges, and then the proposed solution would improve readability. Limiting the number of paragraphs and avoiding interleaved content would also enhance the flow.

The Method section lacks organization and could benefit from a more structured presentation. The neural network application, which is central to the proposed approach, is not discussed in the main paragraphs, resulting in a structural imbalance. Important content should be integrated into the main body rather than relegated to the appendix to improve the paper’s clarity and readability. It is recommended to provide a more detailed description of the content from Appendix B and Appendix E in Section 3.6. If space constraints are a concern, consider simplifying the key concepts in Section 3.1 to make room for these additions.

Lastly, some equations in the Appendix B extend beyond the page boundaries. Attention to formatting standards would enhance the overall presentation.

questions:
Proofreading for Spelling and Formatting: Could the authors carefully review the paper for any spelling and formatting errors to ensure accuracy and readability throughout?

Clarity of Introduction and Main Contributions: In the Introduction, could the authors clarify the primary method of their approach, particularly the use of neural networks as a substitute for MK-HE, rather than emphasizing this only in the contributions section? This adjustment may help readers understand the significance of the method from the outset.

Organization of the Method Section: The main outline of the proposed method is somewhat difficult to follow, and it is challenging to locate the main content regarding the neural network application. Could the authors consider reorganizing this section to more clearly outline the process and central elements? Moving the key explanations from the appendix to the main text may also improve clarity.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730629985952

thread_type:
official_review

<thread_object>
creator: reviewer_5j5u

<content>
summary:
This paper proposes a novel privacy-preserving federated learning method that attempts to integrate multi-key homomorphic encryption with neural networks. Each client generates a public key and two private keys using KeyGen with a security parameter $\kappa$. During the encryption phase, plaintext and private keys are input into the encryption model held by each client for encryption. In the aggregation phase, the ciphertexts and public keys are input into the decryption model held by the aggregator for decryption. The training process employs adversarial training, aiming to maximize the error in attacker's data reconstruction while minimizing the loss after data aggregation. The authors define two attack models: Pseudo N-1 Collusion Attack based on the Original Model (PCAOM) and Pseudo N-1 Collusion Attack based on the Public Dataset (PCAPD), achieving privacy-protected federated learning under these attacks.

strengths:
- **Originality**: The paper introduces an innovative privacy-preserving federated learning method that combines homomorphic encryption with neural networks, enhancing the security and usability of the model.
- **Effectiveness**: The research demonstrates the effectiveness of enhancing data privacy through adversarial training, increasing the model's robustness against complex attack scenarios.
- **Clarity**: The article provides a detailed description of the transformation from the original model to a private model and demonstrates how to defend against two specific attacks.
- **Practicality**: Compared to traditional encryption and decryption methods, the neural network's black-box nature increases the difficulty of attacks. The authors also claim that this method eliminates collaborative decryption, key sharing, and collective key generation among clients, optimizing processing time.

weaknesses:
- **Accuracy**: Since the model is involved in the encryption and decryption process, it cannot guarantee that the parameters obtained by the decryptor are completely correct, only ensuring accuracy within a certain error rate, which is inconsistent with traditional homomorphic encryption standards.
- **Insufficient Proof**: Despite the model's difficulty to be breached due to its black-box nature, there is a lack of rigorous formal proof to support its security claims.
- **Incomplete Documentation**: The paper does not detail the specific implementation of KeyGen, how to ensure Perfect Key Uniformity, or how to resist chosen-plaintext attacks, limiting the method's verifiability and reliability.

questions:
- The paper does not detail how KeyGen operates, whether it is generated by a model or some algorithm, thus we cannot verify how it eliminates key sharing. It is also unclear how Perfect Key Uniformity is ensured, thus it is uncertain how the method resists chosen-plaintext attacks.
- The paper does not provide specific model structures or other information, making it impossible to verify and replicate the authors' experiments.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730687285508

thread_type:
official_review

<thread_object>
creator: reviewer_bvzp

<content>
summary:
The authors develop the first protocol that utilizes neural networks to implement PPFL, as well as incorporating an Aggregatable Hybrid Encryption scheme tailored to the needs of PPFL.

strengths:
Using neural network methods to implement MK-HE is a very interesting direction. The use of hybrid encryption can fully leverage the advantages of both symmetric and asymmetric encryption.

weaknesses:
1. There is a lack of understanding of related work. Methods based on secret sharing inherently have strong resistance to collusion attacks, as demonstrated in works such as (Bell J, Gascón A, Lepoint T, et al. {ACORN}: input validation for secure aggregation[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 4805-4822. Bonawitz K, Ivanov V, Kreuter B, et al. Practical secure aggregation for privacy-preserving machine learning[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017: 1175-1191.). However, the authors did not mention or compare these in the paper.
2. According to the experimental results, although HANs are more computationally efficient than SecFed, the communication overhead increases by dozens of times, as shown by the experimental results in Table 6. This is unacceptable for a large number of users and would limit the practical application of HANs.

questions:
1. How does the performance compare with other schemes that can also resist collusion attacks, such as (Bell J, Gascón A, Lepoint T, et al. {ACORN}: input validation for secure aggregation[C]//32nd USENIX Security Symposium (USENIX Security 23). 2023: 4805-4822. Bonawitz K, Ivanov V, Kreuter B, et al. Practical secure aggregation for privacy-preserving machine learning[C]//Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security. 2017: 1175-1191.)?
2. The additional communication makes the proposed HANs unsuitable for most federated learning scenarios. Is there a way to reduce communication, or is the additional communication unavoidable?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730705324376

thread_type:
official_review

<thread_object>
creator: reviewer_tbh6

<content>
summary:
The paper claims that it presents a novel privacy-preserving federated learning (PPFL) protocol that utilizes neural networks, specifically Homomorphic Adversarial Networks (HANs), to enhance data privacy without significantly sacrificing accuracy. It addresses key limitations of existing PPFL methods, such as accuracy degradation and key management issues, by introducing an Aggregatable Hybrid Encryption (AHE) scheme. This approach enables individual clients to maintain privacy while allowing efficient encryption and aggregation of model updates.

strengths:
1. The article provides a wealth of formal definitions.

2. A novel concept has been proposed.

weaknesses:
1. It is difficult to quickly determine the details of the design AHE scheme, as the related definitions and statements are overly redundant.

2. The experimental analysis provided seems insufficient.

questions:
1. Why did the authors choose simple models to validate the security of the proposed scheme? What I mean is whether sufficient security can be demonstrated under these complex models.

2. The security assessment lacks a systematic approach. Could you provide a more formal and systematic security analysis?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732264624880

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
Dear Reviewers,

We sincerely thank you for your detailed reviews and thoughtful feedback on our manuscript. Your insights and suggestions have been invaluable in helping us improve the quality and rigor of this work. Below, we provide a consolidated response addressing the three primary concerns that were frequently highlighted: communication overhead, the diversity of datasets and models, and rigorous privacy analysis.

1. **Communication Overhead**

   We acknowledge the concern regarding the increased communication cost in our current design and have identified certain unnecessary ciphertext transmissions in the implementation. While this is an important area for optimization, addressing it comprehensively would require significant additional work, including redesigning the ciphertext structures and aggregation mechanisms. To avoid overcomplicating the current paper and to ensure clarity of our core contributions, we believe it is more appropriate to pursue this topic in follow-up research. To reflect this, we have updated the manuscript to explicitly include communication optimization as an important direction for future work.

2. **Diversity of Datasets and Models**

   We appreciate the suggestion to expand our experiments to include a broader range of datasets and model architectures. While the current evaluation demonstrates the feasibility and foundational performance of the proposed method, we agree that validating its applicability across more diverse datasets and complex models would further enhance its robustness. To avoid overcomplicating the current paper and to ensure clarity of our core contributions, we believe it is more appropriate to pursue this topic in follow-up research. This extension has been noted as a priority for future work in the updated manuscript.

3. **Rigorous Privacy Analysis**

   We understand the importance of rigorous and formal security proofs in privacy-preserving research. However, the black-box nature of our neural network-based encryption presents challenges for applying traditional cryptographic proof techniques. While the experimental evaluations and attack simulations conducted in this work provide a solid initial foundation, we recognize that a more formal and systematic security analysis would strengthen the theoretical grounding of our approach. To avoid overcomplicating the current paper and to ensure clarity of our core contributions, we believe it is more appropriate to pursue this topic in follow-up research. This limitation and our plans to address it in future studies have been included in the revised manuscript.

While we fully acknowledge the significance of these concerns and recognize the potential for further improvement, we believe the primary contribution of this work lies in introducing and validating a novel framework. By presenting this innovative approach, we aim to inspire further interest and collaborative research within the community to address these and related challenges.

Once again, we are deeply grateful for your thoughtful feedback, which has greatly helped us refine our work. Thank you for your valuable time and effort in reviewing this manuscript.

Sincerely,  
The Authors
</content>
</thread_object>

</thread>


Metareview:
metareview:
The paper presents a privacy-preserving federated learning (PPFL) protocol using homomorphic adversarial networks. Reviewers raised several critical concerns, including the excessive communication overhead,  a lack of formal security proof, and the missing comparison of related work. The authors' rebuttal failed to adequately address these issues. Given the overall negative reception, I recommend rejection.