A Federated Machine Learning System that Protects Privacy and Defends against Poison Attacks

Q: What performance difference is reported between using the security mechanism and not using it?

For four client threads with 1000 training iterations each and four server iterations, the system reports about 3.213 seconds with security and about 335 milliseconds without security.

Aug 3, 2026

Upload by Skyler

A federated machine learning framework is presented to reduce security risks in federated learning, where untrusted clients can degrade model accuracy through poisoned or faulty updates, and where external aggregation can leak client data. The solution combines homomorphic encryption with an aggregation approach that operates on encrypted client vectors and leverages a trusted execution environment for controlled decryption of aggregated results. A proof-of-concept implementation simulates client-server interactions using a neural network model and demonstrates measurable runtime overhead and privacy-oriented processing.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages1

Reading Time3 min

AccessFree to download

Introduction

Algorithm

Prototype

Performance

Future Work

Acknowledgements

Department Of Engineering Arvid Gustafson Honors Poster Presentation 3 May 2023 Advisor: Wensheng Zhang A Federated Machine Learning System that Protects Privacy and Defends against Poison Attacks Introduction Machine learning (ML) refers to using some model, a function that yields some output like a number from an input like numbers or images, often a neural network. This model is calibrated by a continual process of testing, by applying the model to some data, observing its outputs, and adjusting its settings, often with the help of linear algebra. Federated ML (FML) is a way to train such an ML model. In FML, a single server holds an ML model, and distributes is to client computers, which train the received model, sends back recommendations for adjusting its settings. Once all training has completed, or after some time limit, the server then applies these changes upon its model by aggregating or averaging them. Then, the cycle repeats until the model is deemed sufficiently accurate. However, as it stands, FML has some security vulnerabilities. Malicious, incompetent or mistaken clients may recommend adjustments that make the model less accurate, perhaps by using faulty data to train with. Additionally, the server may use some external means of aggregating client results, like the cloud, due to its size. However, the use of such technology can reveal confidential information about these clients, such as inferring the data they used. In order to account for both of these vulnerabilities, we employ the use of Homomorphic Encryption (HE), and a suitable algorithm with it. HE allows for some operations to occur on encrypted data like addition and multiplication. Our algorithm lies in aggregation, accepting client options as encrypted vectors of numbers, and it is shown to the right. It requires access to a Trusted Execution Environment (TEE) to decrypt aggregated random groups of client results. Algorithm /* D – Array of Encrypted Client Results Arrays * M – Array of Magnitudes of Client Results * numWeights – The Size of Client Results * numClients – The Number of Clients * W – Encrypted Initial Model Weights */ Aggregate(W, D, M, numWeights, numClients): /* Generate an array R[NUM_GROUPS][numWeights] * that assigns a client c's weight w to a * group if and only if R[c][w] == 1. * Let N[i] be sqrt( sum ( R[i][*], *) */ For i from 0 until NUM_GROUPS: For j from 0 until numClients: For k from 0 until numWeights: S[k] = R[i][k] / (N[i]*M[j]) C1 = D[j] * encode(S) For k=1; k < numWeights; k <<= 1: C2 = rotate_vector(C1,k) C1 = C1 + C2 C[i][j] = decode(C1[0]) // on TEET[i] = avg( max( abs(C[k][i]-C[k][j]), k), j) L = 1 – T; a = min(L) L = log( (L/a) / (1 .05 - (L/a)) ) + 0.5 a = min(L); L = L – a; a = min(L) If a < 0.05: L.fill(1) Else: L = L / a For i from 0 until numClients: For j from 0 until numWeights: X[j] = L[i] / numClients W += D[i] * encode(X) Prototye To demonstrate this algorithm, we have made a proof-of-concept software application that simulates a FML system. For our ML model, we used a basic Neural Network (NN), a diagram of which can be seen to the right. The NN could be used to model either an XOR gate or a NOR gate, usually an XOR gate. For HE, we used the MS Seal library. However, we ran into trouble using separate programs when MS Seal did not provide a good way to transfer a Ciphertext over a connection, as clients encode their results. Therefore, to simulate interactions between clients and servers, we used a single multithreaded program running on a single computer. This way, we could let the client threads share public key and ciphertexts through shared pointers. An example of output from our program is shown to the right. Performance For 4 client threads with 1000 training iterations each and 4 server iterations: • With Security: 3 seconds and 213 milliseconds. • Without Security: 335 milliseconds. Future Work The next steps this

FAQs

What performance difference is reported between using the security mechanism and not using it?

For four client threads with 1000 training iterations each and four server iterations, the system reports about 3.213 seconds with security and about 335 milliseconds without security.

Aug 3, 2026

Upload by Skyler