Malicious server can infer client label sets from FL gradient guidance (50-84% accuracy)
The claim
A server can recover clients' label distributions from shared guidance matrices with up to 84% accuracy, and PPFLex prevents this leakage while preserving model accuracy
Published as: “Privacy-Preserving Federated Loss Exploration for Vision-Based Perception under Non-IID Data”
So what
Enables privacy-preserving collaborative training of vision models for connected vehicles without sacrificing performance, making federated learning more viable for automotive deployments.
The five-minute version
PPFLex prevents the 50%-84% privacy leakage observed in FedLEx while keeping test accuracy essentially unchanged (FedLEx outperforms FedAvg by up to 28.75% and PPFLex matches FedLEx’s accuracy). The evidence comes from experiments on GTSRB (26,640 images) and BTSC (4,591 training / 2,534 test images) with up to 120 simulated clients; however, MPC adds up to ~30 s overhead for semi-honest protocols and several minutes for malicious security.
What they found 3
- FedLEx outperforms FedAvg by a large margin under non-IID data.
“At α=0.1, FedLEx outperforms FedAvg by an absolute margin of 18.66% on GTSRB and 28.75% on BTSC.”
- Gradient-based guidance vectors leak client label distribution with high accuracy.
“Fig. 4, the attack achieves between 50% and 84% accuracy depending on the configuration.”
- PPFLex achieves comparable model accuracy to plain-text FedLEx.
“The convergence curves of FedLEx and PPFLex closely align, with small discrepancies observed between the two, attributed to the quantization of floating-point operations under MPC.”
What undercuts it the paper’s own results
- MPC quantization introduces small accuracy discrepancies between FedLEx and PPFLex.
Stated limits 3
- The traffic-sign detection problem (small-object detection under motion blur, glare, adverse weather) is out of scope for this work.
- MPC overhead can be several minutes for malicious-security protocols, which may limit real-time deployment.
- Evaluation is limited to two traffic-sign datasets (GTSRB, BTSC) and simulated client partitions.
What’s new here 4
- First to combine FedLEx gradient-based non-IID optimization with MPC secure aggregation.
- Quantifies privacy leakage of FedLEx guidance vectors in traffic-sign federated learning.
- Implements three-party MPC protocols for both model averaging and guidance matrix computation.
- Evaluates trade-offs of semi-honest versus malicious MPC security assumptions in this setting.
Artifacts & methods 7
- FedLExsystem
- PPFLexsystem
- TwoCNN architectureprimitive
- Dirichlet client data partitioningdataset
- Random Forest attack classifierevaluation
- MPC protocols (Replicated2k, Semi2k, PSReplicated2k, SPDZ2k)system
- MP-SPDZ frameworksystem