An Accuracy-Lossless Perturbation Method for Defending Privacy Attacks
  in Federated Learning
  Although federated learning improves privacy of training data by exchanging
local gradients or parameters rather than raw data, the adversary still can
leverage local gradients and parameters to obtain local training data by
launching reconstruction and membership inference attacks. To defend such
privacy attacks, many noises perturbation methods (like differential privacy or
CountSketch matrix) have been widely designed. However, the strong defence
ability and high learning accuracy of these schemes cannot be ensured at the
same time, which will impede the wide application of FL in practice (especially
for medical or financial institutions that require both high accuracy and
strong privacy guarantee). To overcome this issue, in this paper, we propose
\emph{an efficient model perturbation method for federated learning} to defend
reconstruction and membership inference attacks launched by curious clients. On
the one hand, similar to the differential privacy, our method also selects
random numbers as perturbed noises added to the global model parameters, and
thus it is very efficient and easy to be integrated in practice. Meanwhile, the
random selected noises are positive real numbers and the corresponding value
can be arbitrarily large, and thus the strong defence ability can be ensured.
On the other hand, unlike differential privacy or other perturbation methods
that cannot eliminate the added noises, our method allows the server to recover
the true gradients by eliminating the added noises. Therefore, our method does
not hinder learning accuracy at all.
