Secure Generalization through Stochastic Bidirectional Parameter Updates Using Dual-Gradient Mechanism

Abstract

Federated learning (FL) has gained increasing attention due to privacy-preserving collaborative training on decentralized clients, mitigating the need to upload sensitive data to a central server directly. Nonetheless, recent research has underscored the risk of exposing private data to adversaries, even within FL frameworks. In general, existing methods sacrifice performance while ensuring resistance to privacy leakage in FL. We overcome these issues and generate diverse models at a global server through the proposed stochastic bidirectional parameter update mechanism. Using diverse models, we improved the generalization and feature representation in the FL setup, which also helped to improve the robustness of the model against privacy leakage without hurting the model’s utility. We use global models from past FL rounds to follow systematic perturbation in parameter space at the server to ensure model generalization and resistance against privacy attacks. We generate diverse models (in close neighborhoods) for each client by using systematic perturbations in model parameters at a fine-grained level (i.e., altering each convolutional filter across the layers of the model) to improve the generalization and security perspective. We evaluated our proposed approach on four benchmark datasets to validate its superiority. We surpassed the state-of-the-art methods in terms of model utility and robustness towards privacy leakage. We have proven the effectiveness of our method by evaluating performance using several quantitative and qualitative results.

1 Introduction

In recent years, Federated Learning (FL) [26] has gained wide attention across various domains, including healthcare [12, 24, 15], autonomous driving [34], etc., since FL allow clients to locally train data and share only model parameters (not sensitive data) to the global server for aggregation. Current studies [10, 8, 36, 39] highlighted the issue of privacy leakage through shared model parameters, which offers vulnerability to adversaries in the form of different types of attacks. Several attempts have been made to solve the privacy-leakage issues and provide enhanced protection, which includes homomorphic encryption [2, 16], differential privacy [1, 22], and gradient perturbation [30]. These methods attempt to secure the privacy of sensitive data at the cost of computational overhead or sacrifice the model’s efficiency. Researchers aim to maintain utility without sacrificing the model’s accuracy and encrypt the training data [5, 14]. These approaches require sharing classifier model parameters to perform model aggregation at the server and defend against image reconstruction attacks in FL. Following these attempts, Researchers have proven the vulnerability of clients in these methods for label inference attacks and membership inference attacks, and hence not suitable to provide adequate security [29, 10].

Recently, Yutin et al. [25] provided a theoretical analysis of different attacks in FL and highlighted the concerns of privacy leakage due to the sharing of classifier parameters. To overcome the privacy leakage issue, Yutin et al. [25] proposed a Generative Adversarial Network (GAN) based privacy-preserving image distribution sharing scheme (PPIDSG) in FL, which does not require the sharing of classifier model parameters. To secure federated learning, PPIDSG employs GAN-based parameter sharing to learn the distribution of encrypted images and update client models with an aggregated model. However, learning in the encrypted domain involves a trade-off between utility and security. Also, the same global update to different clients limits the generalization of clients. Moreover, the gradients communicated from the global server to clients are also susceptible to various attacks, which can be improved to make the model more secure. Particularly, to avoid privacy leakage, researchers have proposed differential privacy (DP) [1, 22, 31] and gradient perturbation-based methods [40, 30]. The aforementioned approaches ensure resistance to privacy leakage but also sacrifice the performance of FL due to a lack of systematic perturbation in gradients.

Motivated by these observations and considering these gaps, we found scope to improve the utility and security perspectives in FL. Particularly, we focus on: 1) How to retain the model utility when focusing on security by not sharing classifier model parameters in FL communications. 2) How to improve the robustness of the FL setup against different attacks without sacrificing the utility of the model in terms of its classification accuracy. To achieve these objectives, we proposed a novel approach that provides a more generalized and robust update from the global model to clients during FL, which improves the robustness of the model against the different attacks and does not sacrifice the model’s utility while making the model secure. Our stochastic bidirectional update approach uses a dual-gradient mechanism to generate diverse models (in close neighborhoods) for each client, which improves the generalization and security perspective of FL. After obtaining diverse global models, we do not make any further alterations that help retain utility and generalization.

Our Contributions: We propose a novel approach that follows our stochastic bidirectional parameter update mechanism to generate diverse and generalizable global models for different clients. The proposed approach improves the robustness of clients in FL against different data attacks without sacrificing the model’s utility. Our approach makes systematic alterations to the global model using a dual gradient mechanism to make multiple diverse models by using global models from previous FL rounds. The diverse models generated by our method are in a close neighborhood so that clients can improve generalization as well as robustness against privacy attacks. We validated the superiority of our approach using four datasets against state-of-the-art (SOTA) methods. Our method is evaluated considering the model’s utility and robustness against attacks and surpasses the SOTA methods.

2 Related work

Several optimization approaches have been proposed to improve the utility of FL methods. The various optimization methods for FL can be categorized into global variable-based [20, 17], device grouping-based [7, 4, 19] knowledge distillation-based [27, 23, 41]. In FedProx [20], a proximal term is calculated as a squared distance of a global model with local models that helps in regularizing local loss and helps in model convergence. SCAF-FOLD [17] improves local training through global control variables to adjust optimization direction in each round of FL. The device-grouping FL approaches optimize local training by heuristic-based selection of local devices from the device groups for local training, which are grouped based on the specific similarity metric (model similarity). CluSamp [7] performs the client grouping based on sample size or model similarity. FedCluster [4] follows cyclic FL, wherein in each FL round, clients are grouped into multiple groups that perform FL.

Knowledge distillation-based methods help to improve the inference of the FL by using knowledge of the teacher network to teach the student network. FedAUX [27] makes use of an auxiliary dataset for knowledge distillation and initialize server model. FedDF [23] accelerates the FL by using the ensemble model as a teacher model and unlabelled data for knowledge distillation. The global variable-based methods are computationally demanding in terms of additional communication of global variables and proximal term computation over clients. The device grouping methods need to access all local methods to estimate similarity for grouping, which leads to vulnerability for privacy leakage. On the other hand, the knowledge distillation-based methods need additional overhead for computations and datasets for the distillation process.

To ensure security in FL, researchers have proposed various types of defense mechanisms against the attacks. The common attacks in FL include property inference attacks, membership inference attacks, and image reconstruction attacks. In the property inference attack, the adversary aims to determine the specific attributes that belong to a subset of the training data [8]. In a label inference attack, the adversary aims to determine the label attribute. In an image reconstruction attack, the adversary uses gradients sent from the client to the server model to reconstruct the original image. The authors attempted to perform minimization optimization using gradient difference for the original image and dummy image DLG [40], which was further enhanced through the extraction of ground truth labels in iDLG [38]. Gradient Inversion [35] is proposed to reconstruct complex and high-fidelity images using group consistency regularization.

To make secure FL, researchers have also utilized GAN-based methods. The Generative Adversarial Network (GAN) was proposed to generate images resembling real ones using min-max optimization and adversarial loss between the generator and discriminator network [11]. GAN can also be used for image translation, which has also been explored by researchers for defense or attack. The adversary can use GAN to generate the target distribution images in real time [13]. To perform a model extraction attack through a substitute network trained using GAN [38]. Conditional GANs were utilized in FedCG to resist the image reconstruction attack for privacy preservation [32]. Recently, GAN has been used to establish secure FL by using GAN parameters instead of sharing classifier parameters to avoid privacy leakage since GAN holds encrypted domain distribution [25]. To ensure security against attacks, researchers commonly employ DP-based methods [1, 22, 31] or follow gradient pruning, gradient perturbation-based methods [40, 30]. These methods sacrifice performance to resist privacy leakage due to non-systematic gradient alteration in the form of a defense mechanism, which also affects the overall learning of the FL setup.

Considering the aforementioned limitations, our approach improves the utility-security trade-off in FL. To achieve this, we propose a stochastic bidirectional learning approach that allows generalized learning in local clients through diverse updates/ models from the global server such that these diverse solution updates are in close neighborhoods. Using diverse but close neighborhood updates, the clients follow generalized solutions and hence improve the classification accuracy to improve the utility of FL. To ensure security without hurting utility, our approach follows systematic updates in gradients of the diverse solutions sent from the global server to different clients so that updates are optimally closer.

3 Preliminaries

3.1 Overview of Federated Learning

FL follows a cloud-server architecture, which consists of a global server and multiple local clients. In this paper, we consider the FL system to consist of homogenous local client models, i.e., using similar data distribution and having a model structure as of the global model. Assume our FL aims to map input space $\mathcal{X}$ to output space $\mathcal{Y}$ using global model, $\mathcal{S}$ and $\mathcal{N}$ local models represented as {$c_{1}$, $c_{2}$, …, $c_{N}$}. We denote the local dataset for each client $i$ as $\mathcal{D}_{i}$ = {$x_{i,1}$, $x_{i,2}$, …, $x_{i,n_{i}}$} such that $x_{i,j}$ = $(\mathcal{X},\mathcal{Y})\in\mathcal{X}\times\mathcal{Y}$. In FL, global model weights $w_{glb}$ are trained collaboratively by local clients by sharing their learning (local models) with the global server. The conventional method to generate a global model by aggregating the local models is FedAvg [3]. We can formulate the primary objective of FL using Eq. 1.

$$\begin{split}\underset{w}{\text{min}}~{}~{}\mathcal{L}(w)&=\frac{1}{N}\sum_{i=1}^{N}f_{i}(w),\\ \text{where},\quad f_{i}(w)&=\frac{1}{n_{i}}\sum_{j=1}^{n_{i}}l(w;x_{i,j})\end{split}$$ (1)

where, $\mathcal{L}$ denotes the loss terms for the global model, $l$ denotes loss for individual samples, $f_{i}$ comprises the loss of all samples for local client $i$.

3.2 Privacy Leakage Using Attacks in FL

In our work, we hold the assumption that the adversary does not corrupt the training. The client models share their parameters (weights or gradients) with the global model. When all local clients train their models for just one local epoch between two global aggregation operations, using their complete training datasets, we assume these parameters are equivalent. This scenario results in a white-box attack where model parameters and structure are accessible to the adversary.
Label Inference Attack (LIA): Assume each client $C_{k}$ with local dataset $\mathcal{D}_{k}=\{(x_{i},y_{i})\}_{i=1}^{n_{k}}$ where $x_{i}$, $y_{i}$ denotes the $i$-th sample and its ground truth label respectively. Consider local training with batch size, $bs$ with cross-entropy loss, $\mathcal{L}$ for the classification task; we can define the gradient of $\mathcal{L}$ with respect to (wrt) $w$ using Eq. 2

$$\nabla_{w}\mathcal{L}(\mathbf{x},\mathbf{y})=-\frac{1}{bs}\sum_{i=1}^{bs}\sum_{j=1}^{n_{c}}\nabla_{w}[y_{i}(j)\log y_{i}^{\prime}(j)]$$ (2)

where, $n_{c}$ denotes the number of class labels, $y_{i}^{\prime}$ denotes the predicted logit. $y_{i}(j)$=1 if output index $j$ matches ground truth else $y_{i}(j)$=0. In LIA, our aim is to count images present in a batch ($\sum_{i=1}^{bs}y_{i}(j)$) for each class type $j$. For each input $x_{i}$, we can compute gradient wrt network output $z_{i}$ at index $j$ as suggested in (Yin et al. 2021) as shown in Eq. 3:

$$\nabla_{z_{i}(j)}\mathcal{L}(\mathbf{x_{i}},\mathbf{y_{i}})=y_{i}^{\prime}(j)-y_{i}(j)$$ (3)

Further, we can use the uploaded gradient from the classifier model to perform LIA by multiple passes of random samples to the classifier to compute each category count $j$, which leads to privacy leakage [25]. We do not share the classifier parameters, so our method is resistant to LIA. Membership Inference Attack (MIA): In our work, we consider the enhanced MIA [25], defined as follows: Suppose attacker $C_{adv}$ has shadow dataset $\mathcal{D^{*}}$ which contains some images with target distribution but not in the target dataset. To improve attacks, shadow models are rebuilt for victims and other users. Using model parameters from clients, $C_{adv}$ generates a copy of victim model ${M^{victim}}$ and other models ${M^{others}}$ (aggregate if other users $>$ 2). The adversary $C_{adv}$ produces non-overlapping datasets randomly using $\mathcal{D^{*}}$ as $\mathcal{D}^{*}_{\text{victim}}$ and $\mathcal{D}^{*}_{\text{others}}$, which are fed as input to${M^{victim}}$, ${M^{others}}$ respectively. The obtained predictions ${P^{*}_{victim}}$, ${P^{*}_{others}}$ are manually considered with labels as $in$ (member) and $out$ (non-member) respectively. Using obtained predictions and their labels, an inference model ${M_{attack}}$ is trained by the adversary. Since the adversary has a skeptical dataset, it becomes difficult to determine whether the data comes from the victim or other users. $C_{adv}$ fed this dataset to ${M_{attack}}$ to perform MIA to infer data samples, and its success is determined based on correct inferences.
Image Reconstruction Attack (IR): During IR, the adversary attempts to recover the original image through the encrypted image to perform privacy leakage. To achieve this, optimization aimed to minimize the gradient difference obtained through the dummy images $x_{dummy}$ having labels $y_{dummy}$ and gradients shared by victim $\nabla w$. We can formally denote IR using Eq. 4.

$$x_{dummy}=\arg\underset{x}{min}\left\|\frac{\partial\mathcal{L}\left(x,y_{dummy};w\right)}{\partial w}-\nabla w\right\|^{2}$$ (4)

4 Methodology

We propose a stochastic bidirectional parameter update mechanism to improve the utility of clients as well as improve their defense against different attacks. To achieve this, our approach generates diverse and generalizable global models through systematic perturbations using a dual gradient mechanism such that the diverse global models for different clients are in close neighborhoods. Our approach improves the robustness of clients against different attacks without sacrificing model utility.

To validate the effectiveness of our method, we followed the setup similar to PPIDSG [25] and did not share the classifier ($C$) parameters and used GAN to share the parameters from generator ($G$) parameters in FL, where $G$ learns the image distribution in the encrypted domain. We augment training data and encrypt it by utilizing the image distribution scheme proposed by PPIDSG, where we encrypt training images through several transformations like Rotation and augmentation using a pseudo-random bit, image block flipping, and pixel value exchange across channels. We learn target distribution in $G$ by adversarial training with Discriminator, $D$. We used auto-encoder [28] to build a feature extractor $F$ and used a separate classifier network $C$ to train it. The obtained classifier loss is fed to $G$ to help in learning class specific distributions to improve classification.

Our FL setup consists of $K$ clients ($C_{k}$) having their local dataset $\mathcal{D}_{\text{k}}$ with $N$ samples in total. During $FL$, clients update their model locally and share the generator parameters $w$ with the central/global server. The central server takes updates sent from the local clients and aggregate model parameters as shown in Eq. 5, where $\alpha$ and $\mathcal{L}$ denote the learning rate and loss function, respectively.

$$w^{t+1}\leftarrow\sum_{k=1}^{K}\frac{n_{k}}{N}\left(w^{t}-\alpha\nabla L(w^{t};D_{k})\right)$$ (5)

To generate a diverse global model for each client, we proposed a Stochastic Bidirectional Parameter Updates ($SBPU$) strategy, which utilizes the global models from previous FL rounds. We elaborate on our proposed approach as follows:

Figure 1: Visualization of diverse global models obtained using proposed approach ($SBPU$). We generate diverse models in close neighborhoods through systematic updates. It is important to note that we do not make perturbations after generating the diverse models, which helps to retain utility and generalization.

4.1 Stochastic Bidirectional Parameter Updates using Dual-Gradient Mechanism

Our novelty lies in proposing generalized updates for local clients to improve the utility and resist privacy leakage in FL. We validated the superiority of our method over the recent state-of-the-art method [25] (PPIDSG) by following a similar FL set-up (except using the proposed approach to generate diverse global solutions) and a further improvement in model utility and defense across the attacks. To achieve this, we propose a stochastic bidirectional learning mechanism that helps to generate diverse solutions at the global server to update local clients. The generated models at the server are in the neighborhood to provide generalized solutions for FL clients (refer to Fig. 1).

Our approach makes bidirectional systematic alterations in the gradients by modification in model parameters at a fine-grained level (i.e., altering each convolutional filter across the layers of the model), which improves the defense against attacks. These systematic updates provide a diverse model for each client and help them with generalized learning to improve the utility of the model (refer Fig. 1). The overview of the proposed method is provided in Fig. 2.

The overall FL round mainly consists of four steps: 1) The global model sends a diverse model to each client, as shown in Algo. 1. 2) With the received diverse model, each client undergoes local training and then uploads the model parameters (in our case, $G$) to the global model. 3) The global model aggregates the received models from the clients as shown in Eq. 5 to obtain the updated global model. 4) Using the current global model and previous global models, we perform Stochastic Bidirectional Parameter Updates ($SBPU$) to generate diverse models as shown in Algo. 2. For each client, the global model sends one diverse model to assist in its learning in the next round. Finally, we update the global models ($w_{glb}$, $w^{\prime}_{glb}$, $w^{\prime\prime}_{glb}$) for the next stochastic update.

Please note that, for the initial two FL rounds, we initialize $w^{\prime}_{glb}$ and $w^{\prime\prime}_{glb}$ with $w_{glb}$.To perform $SBPU$, we use $StochasticList$ as [-1, $\dots$, -1, 1, $\dots$, 1, -2, $\dots$, -2, 2, …, 2], where the frequency of each stochastic term, i.e., {-1, 1, -2, 2}, equals to $\left\lfloor\frac{f}{4}\right\rfloor$ where $f$ denotes the number of filters present in layer $i$ of global model $w_{glb}$. The $StochasticList$ is randomly shuffled to create diverse models by performing bidirectional parameter updates in filter $j$ from layer $i$. If $StochasticList[j]==\pm 1$, we perform the update under diversity rate $\beta_{1}$ as shown in Line 9 of Algo. 2, else we update under diversity rate $\beta_{2}$ as shown in Line 11 of Algo. 2, where $g_{glb}.i.j$, $g^{\prime}_{glb}.i.j$ denotes the gradient computed for $j$-th filter of $i$-th layer using global models from previous and previous to previous FL rounds, respectively; and $w_{loc}.i.j$ denotes the diverse model obtained after $SBPU$ for $j$-th filter of $i$-th layer.

Algorithm 1 Diverse Models Generation

Input: i) $w_{glb}$, the global model, ii) $w^{\prime}_{glb}$, the previous global model, iii) $w^{\prime\prime}_{glb}$, the previous to previous global model,
iv) $K$, # clients for FL.
Output: i) $w_{diverse}$, the list of diverse models
Intermediate: ($w_{glb},w^{\prime}_{glb},w^{\prime\prime}_{glb}$)

1:$g_{glb}\leftarrow w_{glb}-w^{\prime}_{glb}$ $\triangleright$ gradients using previous model

2:$g^{\prime}_{glb}\leftarrow w_{glb}-w^{\prime\prime}_{glb}$ $\triangleright$ gradients using previous to previous model

3:for $i\leftarrow 1,\ldots,K$ do

4:     $w_{diverse}.\text{append}(SBPU(w_{glb},g_{glb},g^{\prime}_{glb}))$

5:end for

6:return $w_{diverse}$

Algorithm 2 Stochastic Bidirectional Parameter Updates ($SBPU$)

Input: i) $w_{glb}$: global model, ii) $g_{glb}$: gradients using previous run, iii) $g^{\prime}_{glb}$: gradients using previous to previous run, iv) $\beta_{1}$, $\beta_{2}$: diversity rates
Output: i) $w_{loc}$, the mutated weights
$SBPU$($w_{glb},g_{glb},g^{\prime}_{glb}$)

1:$w_{loc}\leftarrow$ $copy(w_{glb})$

2:$L\leftarrow$ the number of layers of $w_{glb}$

3:for $i\leftarrow 1,\ldots,L$ do

4:     $f\leftarrow w_{glb}[i].\text{size}$ $\triangleright$ number of filters

5:     ${StochasticList}\leftarrow\left[-1,-1,\ldots,-1,1,1,\ldots,1,-2,-2,\ldots,-2,2,2,\ldots,2\right]$ $\triangleright$ each type of stochastic element counts to $\left\lfloor\frac{f}{4}\right\rfloor$

6:     $StochasticList\leftarrow\text{Shuffle}(StochasticList)$

7:     for $j\leftarrow 1,\ldots,f$ do

8:         if $StochasticList[j]==\pm 1$ then

9:              $w_{loc}[i][j]\leftarrow w_{glb}[i][j]+\beta_{1}\times{StochasticList}[j]\times g_{glb}[i][j]$

10:         else

11:              $w_{loc}[i][j]\leftarrow w_{glb}[i][j]+\beta_{2}\times{StochasticList}[j]\times g^{\prime}_{glb}[i][j]$

12:         end if

13:     end for

14:end for

15:return $w_{loc}$

Figure 2: The schematic architecture diagram of the proposed approach.

4.2 Overall Architecture

In the GAN setup, $G$ captures the distribution in encrypted space and shares its parameters to perform FL. The original image is fed to $G$ instead of noise as it improves privacy. The generator network, $G$, consists of the encoder, ResNet blocks, and a decoder. To extract features from the original image, the encoder is used, which is fed into the ResNet block to maintain and align the image features into the target domain. Finally, the decoder helps to restore the features of the image. The discriminator network $D$ utilizes the adversarial loss (without conditional labels), $\mathcal{L}_{\text{adv}}$ for effective conversion into the encrypted domain. Consider original image domain ($X$) with distribution $x_{i}\sim p_{\text{data}}(x)$ and target domain $\hat{X}$ with distribution $\hat{x_{i}}\sim p_{\text{data}}(\hat{x})$. For training images with batch size $bs$, we can express the objective using Eq. 4.2 where $G$ and $D$ tires to maximize and minimize the objective, respectively.

$$\mathcal{L}_{\text{adv}}= \ \mathbb{E}_{\hat{x}_{i}\sim p_{\text{data}}(\hat{x})}\left[\log D\left(\{\hat{x}_{i}\}_{i=1}^{b_{s}}\right)\right]$$

$$+\mathbb{E}_{x_{i}\sim p_{\text{data}}(x)}\left[\log\left(1-D\left(G\left(\{x_{i}\}_{i=1}^{b_{s}}\right)\right)\right)\right]$$ (6)

To retain semantic information, we use semantic loss using $l_{1}$ norm as shown in Eq. 7, where $\theta_{G}$ denotes the generator parameters.

$$\mathcal{L}_{\text{sem}}=\sum_{i=1}^{bs}\left\|G_{X\rightarrow\hat{X}}(x_{i};\theta_{G})-\hat{x}_{i}\right\|$$ (7)

Figure 3: High-level representation of different components in the overall architecture.

To improve distribution learning in $G$ towards the class-specific features, we used classification loss $\mathcal{L_{\text{cls}}}$ into $G$. With training epochs, $G$ learns to align generated images into the encrypted domain, and then generator parameters can be shared to the global server by different clients to facilitate FL. To improve the feature learning, we use feature extractor $F$, which consists of Encoder ($Enc$) and decoder $Dec$ networks. The features extracted by $Enc$ are converted into images using $Dec$. To extract efficient features, $F$ tries to minimize the feature distance between the image generated by $G$ and $Dec$ as shown in Eq. 8 where $\tilde{x_{i}}$ denotes the generated image. The classifier $C$ consists of a simple convolutional network and takes features from $F$ to minimize the classification error ($\mathcal{L_{\text{cls}}}$) for $n_{c}$ classes as described in Eq. 9. We compute total loss $\mathcal{L}_{\text{total}}$ as shown in Eq. 10 where $\lambda_{sem}$ and $\lambda_{cls}$ are hyperparameters to control the influence of $\mathcal{L}_{\text{sem}}$ and $\mathcal{L}_{\text{cls}}$ respectively.

$$\mathcal{L}_{\text{fea}}=\sum_{i=1}^{bs}\left\|\text{Dec}(\text{Enc}(\tilde{x}_{i}))-\tilde{x}_{i}\right\|^{2}$$ (8)

$$\mathcal{L}_{\text{cls}}=-\sum_{i=1}^{bs}\sum_{j=1}^{n_{c}}y_{i}(j)\log y^{\prime}_{i}(j)$$ (9)

$$\mathcal{L}_{\text{total}}=\mathcal{L}_{\text{adv}}+\lambda_{sem}~{}\mathcal{L}_{\text{sem}}+\lambda_{cls}~{}\mathcal{L}_{\text{cls}}$$ (10)

4.3 Convergence Analysis

Our global model is aggregated from all the trained local models similar to FedAvg. Let $t$ denote the $t^{th}$ SGD iteration on the local client, and each local client undergoes $E$ SGD training iterations, $w_{glb}$ denotes the aggregated model. For $i=1,2,\dots,K$, our method satisfies the following property:

$$\alpha^{2}\|{w}_{{glb}}^{n}-{w}_{{glb}}^{n-1}\|^{2}\leq\|{w}_{{i,n}}^{loc}-{w}_{{glb}}^{n}\|^{2}\leq 4\alpha^{2}\|{w}_{{glb}}^{n}-{w}_{{glb}}^{n-1}\|^{2}$$ (11)

where $\mathbf{w}_{i,n}^{{loc}}$ denotes the $i^{th}$ mutated weights in the $n^{th}$ round. Inspired by [21], the following assumptions on the loss functions of local clients (i.e., $f_{1},f_{2},\dots,f_{K}$) can be considered.
Assumption 1: For $i\in\{1,2,\dots,K\}$, $f_{i}$ is $L$-smooth, where $f_{i}(v)\leq f_{i}(w)+(v-w)^{T}\nabla f_{i}(w)+\frac{L}{2}\|v-w\|_{2}^{2}$.
Assumption 2: For $i\in\{1,2,\dots,K\}$, $f_{i}$ is $\mu$-strongly convex, where $f_{i}(v)\geq f_{i}(w)+(v-w)^{T}\nabla f_{i}(w)+\frac{\mu}{2}\|v-w\|_{2}^{2}$.
Assumption 3: The variance of stochastic gradients is bounded by $\sigma_{i}^{2}$, i.e., $\mathbb{E}\|\nabla f_{i}(w;\xi)-\nabla f_{i}(w)\|^{2}\leq\sigma_{i}^{2}$, where $\xi$ is a data batch of the $i^{th}$ client in the $t^{th}$ FL round.
Assumption 4: The expected squared norm of stochastic gradients is bounded by $G^{2}$, i.e., $\mathbb{E}\|\nabla f_{i}(w;\xi)\|^{2}\leq G^{2}$.
Based on these assumptions, our convergence can be obtained as:
Theorem 1. (Convergence of SBPU) Let Assumption 1-4 hold. If there are $n$ FL rounds during the FL training process. Let $T=n\times E$ denotes total number of SGD iterations and $\eta_{t}=\frac{2}{\mu(t+\gamma)}$ is learning rate. Let $\kappa=\frac{L}{\mu}$, $\gamma=\max(8\kappa,E)$. We have

$$\mathbb{E}[f({w}_{T})-f^{*}]\leq\frac{4\kappa}{\gamma+T}(\frac{B}{2\mu}+L\|{w}_{1}-{w}^{*}\|^{2})$$ (12)

where $B=\frac{1}{K^{2}}\sum_{i=1}^{K}\sigma_{i}^{2}+\frac{32\alpha^{2}}{1-4\alpha^{2}}(E-1)^{2}G^{2}$. Theorem 1 computes loss for SBPU between $f^{*}$ (optimal weight) and $f({w}_{T})$ in the $T^{th}$ interaction and indicates a convergence rate similar to FedAvg (detailed in [21]). We have provided full proof of convergence analysis of SBPU in the supplementary material.

5 Experimental Setup and Results Obtained

5.1 Dataset Used and Implementation Setup

We implemented the proposed approach using the PyTorch programming framework using NVIDIA RTX A5000 GPU with 24GB GPU memory. We evaluated our model on four datasets MNIST [6], FMNIST [33], CIFAR10 [18], and SVHN [37] as per official train-test split. To perform different attacks, we randomly select any one client as a victim.

5.2 Implementation Details

For a fair comparison with recent benchmark PPIDSG [25], we followed a similar setting, i.e., homogeneous distribution across clients in the FL system [26] having 10 clients with equal training data access. We followed a batch size of 64 for GAN. We used block sizes ($B_{x}$ and $B_{y}$) for image encryption as 4. The generator and discriminator network have been trained using Adam optimizer with a learning rate (lr) of 0.0002. For the feature extractor ($F$) and classifier ($C$), we used an SGD optimizer with an lr of 0.01 and weight decay of 0.001. We keep the initial lr constant for the first 20 global iterations and then follow linear decrement until it converges to 0. In Eq. 10, we used $\lambda_{sem}$=1 and $\lambda_{cls}$=2 and train model for 100 rounds. We used $\beta$ = 0.025, 0.25, 0.15, and 1.1 in our learning rule for MNIST, FMIST, CIFAR10, and SVHN datasets, respectively. We defined $\beta_{1}$ and $\beta_{2}$ as $\beta$ and $\beta^{2}$, respectively. For further details, please refer to the supplementary material.

5.3 Defense Baselines

To evaluate the robustness of our model against different attacks, we compared it against several defense mechanisms, i.e., 1) ATS [9] (to find optimal image transformation through automatic transformation search) 2) EtC [5] (encrypt image using block-based image transformation) 3) DP [31] (use clipped gradient with gaussian noise during model training) 4) GC [40] follows gradient pruning to avoid privacy leakage 5) FedCG [32] use conditional GANs for privacy preservation in FL 6) PPIDSG [25] (share GAN parameters during FL rather than classifier to ensure privacy preservation). For differential privacy (DP), we kept the privacy budget as $\epsilon/T$ for $T$ global training epochs with clipping hyperparameter $C$ and denoted as DP $<$$\epsilon,C$$>$.

5.4 Utility and Robustness Against Attacks

To validate the utility of the model, we select a random user to evaluate classification performance since our approach doesn’t have a global classification model. We provide the highest classification accuracy obtained by our model and compare it with different techniques in Table 1. Our method surpassed the state-of-the-art (SOTA) methods and obtained the highest classification accuracy. For CIFAR10, we observed significant improvement in classification accuracy. It is important to note that ATS and EtC defense policies utilize ResNet-18 as a classifier, which mainly determines the model utility and affects the classification accuracy. Our model uses a simple classifier network and is able to improve model utility mainly due to diverse and generalized updates to clients. To ensure effectiveness against attacks, our approach does not share the classifier parameter. Since we do not share the classifier model, our model becomes robust against Label Inference Attack (LIA). We have shown the robustness of other defense methods against LIA using different activation functions and architecture in the supplementary material. We considered enhanced Membership Inference Attack (MIA) as proposed in [25] for evaluation. We compared our defense accuracy against MIA with other defense mechanisms in Table 2.

Due to page limit constraints, we provided additional results, such as model utility and its robustness against MIA under $Part$ and $All$ settings for the remaining datasets in the supplementary material. For Reconstruction Attack (RA), we do not share the classifier model parameters with the global model, so the adversary fails to perform RA on our approach and attempts to reconstruct the image using generator parameters. In Fig. 4, we provide the quantitative and qualitative comparison of different mechanisms with the proposed approach against RA.

Figure 4: Comparative analysis under reconstruction attack. Here, a small PSNR value denotes privacy preservation, i.e., the robustness of the model against IR attack. Through histogram plots, we can see that the generated image for a given CIFAR10 sample is encrypted and does not reveal visual information (either visually or through pixel distribution), which affirms the effectiveness of our method.

Figure 5: Comparison with PPIDSG using CIFAR10 and FMNIST.

Method	CIFAR10 $\uparrow$	SVHN $\uparrow$
ATS	59.67	85.22
EtC	53.34	78.7
DP1	49.29	82.7
DP2	44.43	80.28
GC1	54.07	84.36
GC2	50.91	79.96
FedCG	53.2	79.71
PPIDSG	70.56	91.53
Ours	75.06	92.36

Table 1: Comparison of classification accuracy (%) obtained for different policies on various datasets. Here, DP1: DP$<$5,10$>$, DP2: DP$<$20,5$>$, GC1: GC (10%), GC2: GC (40%).

Method	CIFAR10		SVHN
	Part $\downarrow$	All $\downarrow$	Part $\downarrow$	All $\downarrow$
ATS	84.3	73.51	54.78	52.41
EtC	55.84	46.83	50.04	63.89
DP1	69.6	68.74	56.37	63.55
DP2	70.28	65.95	59.37	55.76
DP3	87.17	75.47	62.21	55.19
DP4	73.71	56.44	59.31	57.53
DP5	74.29	66.64	58.66	58.66
GC1	75.56	72.43	60.74	58.31
GC2	67.41	61.18	56.37	56.01
GC3	83.71	84.16	58.13	54.24
FedCG	49.84	70.03	51.18	53.72
PPIDSG	54.39	52.54	52.35	47.21
Ours	40.31	36.11	49.44	39.52

Table 2: The MIA accuracy (%) obtained for different defense mechanisms on CIFAR10 and SVHN dataset under $Part$ and $All$ settings. Here, lower accuracy shows the robustness of the model in resisting the privacy leakage against the MIA. Here, DP1, DP2, DP3, DP4, DP5, GC1, GC2, and GC3 denote DP$<$5,10$>$, DP$<$10,10$>$, DP$<$20,10$>$, DP$<$20,5$>$, DP$<$20,20$>$, GC(10%), GC(20%), and GC(40%).

DatatSet	$\beta$	SingleGrad	DualGrad	TripleGrad
CIFAR10	0.15	0.17(0.62)	0.17(0.54)	0.19(0.59)
	0.25	0.15(0.66)	0.15(0.56)	0.20(0.60)
	0.5	0.16(0.71)	0.16(0.59)	0.10(0.67)
	1.5	0.16(0.67)	0.15(0.67)	0.24(0.78)

Table 3: Ablation study to decide stochastic bidirectional update mechanism under different global models consideration. The values present outside and inside the brackets denote the F1-score obtained by member and non-member, respectively.

.

Dataset	Train (seconds)		Test ($\times 10^{-4}$ seconds)
	PPIDSG	Proposed	PPIDSG	Proposed
MNIST	111.76	112.90	$2.59$	$2.62$
CIFAR10	123.52	125.26	$2.58$	$2.65$
SVHN	186.73	187.99	$2.56$	$2.64$
FMNIST	111.30	111.79	$2.54$	$2.60$

Table 4: Comparison of training time (per epoch) and testing time (per image) for PPIDSG and the proposed method (SBPU) across different datasets.

5.5 Ablation Study

To decide the proposed stochastic bidirectional parameter update strategy, we performed ablation to analyze the effect of varying the number of global models (one, two, three, i.e., SingleGrad, DualGrad, and TripleGrad) to consider from previous FL rounds. SingleGrad, DualGrad, and TripleGrad consider stochastic terms for $StochasticList$ as {$\pm$ 1} with diversity rate: $\beta$; {$\pm$ 1, $\pm$ 2} with diversity rate: $\beta$, $\beta^{2}$; and {$\pm$ 1, $\pm$ 2, $\pm$ 3} with diversity rate: $\beta$, $\beta^{2},\beta^{3}$, respectively. We provided these ablations in Table 3. We performed ablation to analyze the effect of i) block size for image encryption, ii) the number of clients, and iii) the Effect of varying diversity rates, iv) compared the defense accuracy of our approach with SOTA settings: original image and no update; and provided results in the supplementary material. While comparing our method over PPIDSG using different numbers of clients, we found our method better, confirming its reliability and practical utility. We have shown the effect of increasing clients for both methods using CIFAR10 and FMNIST datasets in Fig. 5.

Comparison of train and test time: Our proposed method (SBPU) takes almost the same time as PPIDSG during the training and testing phase and offers significant performance improvement. We provide a comparative analysis of the time taken by both methods on different datasets in Table 4, which supports its practical utility.

6 Conclusion and Future Work

Our work makes a significant contribution to generate diverse global models for clients to improve the generalization and robustness against different privacy attacks. Our method follows the stochastic bidirectional update mechanism, which offers systematic perturbations to the global model in the parameter space of the model to generate diverse updates for clients. We validated the significance and utility of the proposed method through extensive experimentation on four datasets and surpassed the available SOTA methods. While improving privacy leakage issues during attacks, our method does not sacrifice the performance and improves the utility-security trade-off in FL. Our method offers an opportunity for future researchers to optimize existing marginal computation overhead in SBPU and explore more sophisticated bidirectional update methods. In the future, we can validate SBPU robustness across diverse data types in security-critical areas like healthcare, social media, and surveillance.