🤖 AI Summary
In federated learning, sharing gradients exposes models to gradient inversion attacks, compromising data privacy; while fully homomorphic encryption (FHE) offers strong protection, its computational overhead is prohibitive. Existing selective encryption approaches rely on heuristic parameter tuning and lack theoretical foundations. This paper establishes the first theoretical framework for selective gradient encryption, revealing an intrinsic relationship between gradient spectral characteristics and privacy preservation capability. It formally characterizes how encryption ratio, model complexity, and exposed gradient volume jointly govern defense efficacy. Methodologically, we integrate gradient spectral analysis with lightweight homomorphic encryption to achieve a Pareto-optimal trade-off between privacy and efficiency. Extensive experiments validate the effectiveness of our key design principles. Our work provides both a rigorous theoretical foundation and a systematic design methodology for practical, scalable privacy-preserving federated learning.
📝 Abstract
Federated Learning (FL) enables collaborative model training while preserving data privacy by keeping raw data locally stored on client devices, preventing access from other clients or the central server. However, recent studies reveal that sharing model gradients creates vulnerability to Model Inversion Attacks, particularly Deep Leakage from Gradients (DLG), which reconstructs private training data from shared gradients. While Homomorphic Encryption has been proposed as a promising defense mechanism to protect gradient privacy, fully encrypting all model gradients incurs high computational overhead. Selective encryption approaches aim to balance privacy protection with computational efficiency by encrypting only specific gradient components. However, the existing literature largely overlooks a theoretical exploration of the spectral behavior of encrypted versus unencrypted parameters, relying instead primarily on empirical evaluations. To address this gap, this paper presents a framework for theoretical analysis of the underlying principles of selective encryption as a defense against model inversion attacks. We then provide a comprehensive empirical study that identifies and quantifies the critical factors, such as model complexity, encryption ratios, and exposed gradients, that influence defense effectiveness. Our theoretical framework clarifies the relationship between gradient selection and privacy preservation, while our experimental evaluation demonstrates how these factors shape the robustness of defenses against model inversion attacks. Collectively, these contributions advance the understanding of selective encryption mechanisms and offer principled guidance for designing efficient, scalable, privacy-preserving federated learning systems.