[Paper Review] MixNN: Protection of Federated Learning Against Inference Attacks by Mixing Neural Network Layers

Antoine Boutet, Thomas Lebrun+2 more|arXiv (Cornell University)|Sep 26, 2021

Privacy-Preserving Technologies in Data44 references4 citations

TL;DR

MixNN is a proxy-based framework that enhances federated learning privacy by mixing neural network layers across participants before aggregation, preventing attribute inference attacks without sacrificing model utility. It achieves strong privacy protection—outperforming local differential privacy—while maintaining the same model accuracy as standard federated learning.

ABSTRACT

Machine Learning (ML) has emerged as a core technology to provide learning models to perform complex tasks. Boosted by Machine Learning as a Service (MLaaS), the number of applications relying on ML capabilities is ever increasing. However, ML models are the source of different privacy violations through passive or active attacks from different entities. In this paper, we present MixNN a proxy-based privacy-preserving system for federated learning to protect the privacy of participants against a curious or malicious aggregation server trying to infer sensitive attributes. MixNN receives the model updates from participants and mixes layers between participants before sending the mixed updates to the aggregation server. This mixing strategy drastically reduces privacy without any trade-off with utility. Indeed, mixing the updates of the model has no impact on the result of the aggregation of the updates computed by the server. We experimentally evaluate MixNN and design a new attribute inference attack, Sim, exploiting the privacy vulnerability of SGD algorithm to quantify privacy leakage in different settings (i.e., the aggregation server can conduct a passive or an active attack). We show that MixNN significantly limits the attribute inference compared to a baseline using noisy gradient (well known to damage the utility) while keeping the same level of utility as classic federated learning.

Motivation & Objective

• Address privacy leaks in federated learning where a malicious or curious aggregation server can infer sensitive attributes from model updates.
• Develop a privacy-preserving mechanism that does not degrade model utility, unlike existing approaches such as differential privacy.
• Design a novel attribute inference attack, \attackss, to evaluate the vulnerability of standard federated learning to such threats.
• Propose a practical, efficient, and deployable solution using trusted execution environments (Intel SGX) to isolate and mix model updates securely.

Proposed method

• Introduce a proxy server that receives model updates from clients and mixes layers across different participants before forwarding them to the aggregation server.
• Use Intel SGX enclaves to ensure confidentiality and integrity of the mixing process, protecting against side-channel and tampering attacks.
• Apply a data-oblivious mixing strategy to prevent side-channel leakage by ensuring uniform execution time and memory access patterns.
• Leverage the fact that model aggregation is invariant to layer permutation, so mixing does not affect the final global model performance.
• Design \attackss, a new attribute inference attack exploiting gradients from the SGD algorithm to infer private attributes from model updates.
• Implement and evaluate MixNN on CIFAR-10 using a two-convolutional-layer, three-full-connected-layer model, with processing times of 0.19s per update and 26.9MB memory usage per update in the enclave.

Experimental results

Research questions

• RQ1 Can a proxy-based layer-mixing mechanism effectively prevent attribute inference attacks in federated learning without degrading model utility?
• RQ2 How does the privacy leakage in federated learning via the SGD algorithm enable new attribute inference attacks, and how can they be quantified?
• RQ3 To what extent does MixNN reduce attribute inference success compared to state-of-the-art defenses like local differential privacy?
• RQ4 What is the performance overhead of MixNN in terms of latency and memory usage, and is it practical for real-world deployment?

Key findings

• MixNN significantly reduces attribute inference attack success rates compared to a baseline using local differential privacy, while maintaining the same model accuracy as standard federated learning.
• The proposed \attackss attack successfully infers private attributes from model updates by exploiting gradients in the SGD process, demonstrating a critical privacy vulnerability in standard federated learning.
• MixNN introduces only a negligible 0.03s average overhead for the mixing operation and 0.19s total processing time per update (including decryption and storage), making it practical for real-world deployment.
• The system achieves strong privacy guarantees through Intel SGX, with data-oblivious execution preventing side-channel leaks, and the mixing process is agnostic to model structure, ensuring broad compatibility.
• The framework maintains the same convergence and utility as classical federated averaging because layer mixing does not alter the outcome of model aggregation.
• Experiments show that MixNN provides better privacy protection than local differential privacy without any trade-off in model utility, making it a superior alternative for privacy-preserving federated learning.