Tailoring Noise to Fit: An Adaptive Noise Optimization Mechanism Against Gradient Leakage
摘要
Federated Learning (FL) is widely regarded as an effective privacy-preserving learning framework, as it keeps clients’ training data local while only transmitting model updates. However, the Gradient Leakage Attack (GLA) can reconstruct clients’ local data through transmitted gradients, posing a significant privacy threat to FL. Existing defense strategies against the GLA have the following limitations: (1) cryptography-based defenses impose high computational and communication costs, rendering them impractical for the typically resource-constrained FL clients; (2) perturbation-based defenses fail to dynamically adapt to the unique characteristics of each client’s data, challenging the achievement of good utility-privacy trade-offs. To overcome these limitations, we introduce ANOM (Adaptive Noise Optimization Mechanism), a novel defense mechanism that customizes noise to align with local data attributes, thereby achieving a more favorable utility-privacy trade-off. Our comprehensive experimental evaluation demonstrates ANOM’s superior capability to balance utility and privacy. Across all defenses, ANOM results in the minimal accuracy reduction on public datasets when compared to the unprotected model scenario. In terms of privacy preservation, ANOM outperforms the current state-of-the-art defense, Outpost, in nearly all assessed experimental settings.