MixNN: Protection of Federated Learning Against Inference Attacks by
  Mixing Neural Network Layers
  Machine Learning (ML) has emerged as a core technology to provide learning
models to perform complex tasks. Boosted by Machine Learning as a Service
(MLaaS), the number of applications relying on ML capabilities is ever
increasing. However, ML models are the source of different privacy violations
through passive or active attacks from different entities. In this paper, we
present MixNN a proxy-based privacy-preserving system for federated learning to
protect the privacy of participants against a curious or malicious aggregation
server trying to infer sensitive attributes. MixNN receives the model updates
from participants and mixes layers between participants before sending the
mixed updates to the aggregation server. This mixing strategy drastically
reduces privacy without any trade-off with utility. Indeed, mixing the updates
of the model has no impact on the result of the aggregation of the updates
computed by the server. We experimentally evaluate MixNN and design a new
attribute inference attack, Sim, exploiting the privacy vulnerability of SGD
algorithm to quantify privacy leakage in different settings (i.e., the
aggregation server can conduct a passive or an active attack). We show that
MixNN significantly limits the attribute inference compared to a baseline using
noisy gradient (well known to damage the utility) while keeping the same level
of utility as classic federated learning.
