ADPF: Anti-inference differentially private protocol for federated learning

Abstract

With the popularity of commercial artificial intelligence (AI), the importance of individual data is constantly increasing for the construction of large models. To ensure the utility of the released model, the security of individual data must be guaranteed with high confidence. Federated learning (FL), as the common paradigm for distributed learning, are usually subjected to various external attacks such as inversion attack or membership inference attack. Some solutions based on differential privacy (DP) are proposed to resist data revelation. However, the intelligence and collusion of adversaries are often underestimated during the training process. In this paper, an anti-inference differentially private federated learning protocol ADPF is proposed for data protection in an untrusted environment. ADPF models the attacker-defender scenario as a two-phase complete information dynamic game and designs optimization problems to find optimal budget allocations in different phases of training. Comparative experiments demonstrate that the performance of ADPF outperforms state-of-the-art differentially private federated learning protocol in both attack resistance and model utility.