FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning

1 Introduction

Deep neural networks (DNN) have achieved dramatic success in many areas, including computer vision, natural language processing, and recommendation systems. Their success largely depends upon the availability of a wealthy amount of training data. In many real-world applications, however, training data is typically distributed across different organizations, which are unwilling to share their data because of privacy and regulation concerns directly. To alleviate these concerns, federated learning (FL) [McMahan et al., 2017] is proposed to enable multiple clients to collaboratively build DNN models without sharing clients' private data.

∗Co-first authors contributed equally

†Contact Author

However, recent works have empirically demonstrated that the classic federated averaging method (FedAvg [McMahan et al., 2017]) and its variants (e.g., FedProx [Li et al., 2020]) are vulnerable to gradient-based privacy attacks such as the deep leakage from gradients (DLG) [Zhu and Han, 2020], which is able to reconstruct the original data of clients from publicly shared gradients and parameters. Varieties of technologies have been leveraged to further improve the privacy of FL, the most popular ones are homomorphic encryption (HE) [Gentry and others, 2009] and differential privacy (DP) [Dwork et al., 2014]. HE provides a highlevel security guarantee by encrypting exchanged information among clients. Nonetheless, its extremely high computation and communication cost make it unsuitable to DNN models. While DP imposes a low complexity on FL, it causes precision loss and still suffers from data recovery attacks. To prevent data leakage and still enjoy the benefits of FL, FEDSPLIT [Gu et al., 2021] combining split learning [Gupta and Raskar, 2018] and FL proposes to split a client's network into private and public models, and protect privacy by hiding private model from the server. However, FEDSPLIT experiences a non-negligible performance drop because the private models are not engaged in the FL.

In this work, we propose FEDCG, a novel federated learning method that leverages conditional generative adversarial networks [Mirza and Osindero, 2014] to achieve high-level privacy protection resisting DLG attack while still maintaining competitive model performance compared with baseline FL methods. More specifically, FEDCG decomposes each client's local network into a private extractor and a public classifier, and keeps the extractor local to protect privacy. The novel part of FEDCG is that FEDCG shares clients' generators in the place of extractors with the server for aggregating clients' shared knowledge aiming to enhance model performance. This strategy has two immediate advantages. First, the possibility of clients' data leakage is significantly reduced because no model that directly contacts with original data is exposed, as compared to FL methods in which the server has full access to clients' local networks (e.g., FEDAVG and FEDPROX). Second, the server can aggregate clients' generators and classifiers using knowledge distillation [Hinton et al., 2015] without accessing any public data.

The main contributions of this work are:

• To the best of our knowledge, this work is the first attempt to integrate cGAN into FL aiming to protect clients' data privacy while enabling clients to have competitive model performance.
• Extensive experiments demonstrate that FEDCG can achieve competitive performance and provide privacy analysis to prove that FEDCG is superior in privacy protection compared with baseline FL methods.

2 RelatedWork

2.1 Federated Learning

Federated learning (FL) is a distributed machine learning paradigm that enables clients (devices or organizations) to train a machine learning model collaboratively without exposing clients' data. The concept of FL was first proposed by [McMahan et al., 2017]. Further, many serious challenges emerge with the development of FL. Particularly, the "naked" FL methods without any privacy protection mechanism are proven to be vulnerable to data recovery attacks such as deep leakage [Zhu and Han, 2020] and model inversion [Fredrikson et al., 2015]. Therefore, a wealth of technologies have been proposed to improve the privacy of FL. The most popular ones are homomorphic encryption (HE) and differential privacy (DP). However, HE is extremely computationally expensive, while DP suffers from non-negligible precision loss. Another school of FL [Gupta and Raskar, 2018; Gu et al., 2021] tries to strike a balance between privacy and efficiency by splitting a neural network into private and public models and sharing only the public one.

2.2 DLG in Federated Learning

Federated learning is proposed to protect data privacy by keeping private data localized and sharing only model gradients or parameters. However, recent research on Deep Leakage from Gradients (DLG) demonstrates [Zhu and Han, 2020] that shared gradients can actually leak private training data. Particularly, DLG can achieve pixel-wise level data recovery without any assistance information. The follow-up work [Geiping et al., 2020] further extends DLG to more realistic settings where gradients are averaged over several iterations or several images and shows that users' privacy is not protected in these settings. GRNN [Ren et al., 2021] improves DLG by recovering fake data and labels through a generative model instead of regressing them directly from random initialization.

2.3 GAN In Federated Learning

Recent research works that utilize GAN in the FL setting focus mainly on two lines of works: One is leveraging GAN to perform data recovery attacks. [Hitaj et al., 2017] assumes a malicious client that utilizes the shared model as the discriminator to train the generator in a GAN. Then, the trained generator is used to mimic the training samples of the victim client. Another is to train high-quality GAN across distributed data sources under privacy, efficiency, or heterogeneity constraints. MD-GAN [Hardy et al., 2019] proposes a system that the server hosts the generator while each client hosts a discriminator. The discriminators communicate with each other in a peer-to-peer fashion for improving computational efficiency. FedGAN [Rasouli et al., 2020] trains a GAN across Non-IID data sources in a communication efficient way, but it may produce biased data.

3 ProposedMethod

3.1 ProblemFormulation

In this work, we consider typical federated learning (FL) setting that includes a central server and N clients holding private datasets {X1,X2, ...,Xn}. These private datasets share the same feature space but have different sample spaces.

Each client i has a classification network parameterized by θEi,Ci := [θEi ; θCi ] consists of a feature extractor Ei : Xi → Rd parameterized by θEi , and a classifier Ci : Rd → Rc parameterized by θCi , where d is the feature dimension and c is the number of classes. For protecting privacy and maintaining competitive performance, each client is provided with a conditional GAN (cGAN) consisting of a generator Gi : Z → Rd parameterized by θGi , and a discriminator Di : Rd → I parameterized by θDi , where Z is the Gaussian distribution and I indicates a single scalar in the range of [0, 1]. The training procedure of the cGAN is performed locally aiming to train the generator Gi to approximate the extractor Ei such that Gi(z, y) captures the distribution of features extracted by Ei(x|y).

As illustrated in Figure 1, the workflow of FEDCG goes as follows: in each FL communication round, each client i uploads its Gi and Ci to the server once the local training is completed while keeps the Ei and Di local to strengthen privacy protection. Then, the server applies knowledge distillation to build a global generator Gg and a global classifier Cg. Next, clients download Gg and Cg to replace their corresponding local models and start the next training iteration.

In our FEDCG, clients collaboratively train the global generator and classifier with the help of the central server, while each client leverages the global generator and global classifier to build a personalized local classification network that can perform well on its local test dataset. We will elaborate on this in the following two sections.

3.2 Two-stage Client Update

The client's local training procedure involves two stages: classification network update and generative network update. Figure 2 illustrates the two stages while Algorithm 1 describes the detailed procedure.

In the classification network update stage (Algo 1, lines 39), each client i optimizes its extractor θEi and classifier θCi by minimizing the classification loss:

where Ω is cross-entropy function. In addition, client i also wants to integrate the shared knowledge embedded in the global generator (aggregated in the previous round) into its local extractor. To this end, it freezes the global generator θGg and optimizes its local extractor θEi by minimizing the mean-square-error loss as follows:

Then, we have the task loss Ltask , which is the combination of Lcls and Ldist , and is formalized by:

where the γ is a non-negative hyperparameter that adjusts the balance between the two loss terms. In this work, γ gradually increases from 0 to 1 as the global generator becomes more accurate in producing feature representations during training.

In the generative network update stage (Algo 1, lines 1018), each client i wants to approximate its local generator's output to the feature representations extracted by its local extractor. To this end, it freezes the parameters θEi of extractor Ei and conducts a cGAN training procedure to train the generator. More specifically, it samples a mini-batch of training data (x, y) and feeds x to the Ei to obtain the "groundtruth" feature representations h. Then, it randomly generates Gaussian noises z with the same batch size and feeds (z, y) to generator Gi to generate estimated feature representations ˆh. Next, it feeds h and ˆh to discriminator Di to calculate discriminator loss Ldisc and generator loss Lgen according to

Algorithm 1 Two-stage Client Update

Input: clients' datasets {Xi}ni=1 ; clients' extractors, classifiers, generators and discriminators: {Ei(·; θEi ), Ci(·; θCi ), Gi(·; θGi ), Di(·; θDi )}ni=1 ; global generator {Gg(·; θGg ) and global classifier Cg(·; θCg }); learning rate η1, η2; local training epoch T

1: Clients receive θGg and θCg from the server. 2: for each client i = 1, ...,N in parallel do 3: θCi ← θCg ; 4: for t ∈ {1, ..., T} do 5: for all x, y ∈ Xi do 6: sample z from N(0, 1) 7: θEi,Ci ← θEi,Ci - η1∇θEi,Ci Ltask (x, y, z) 8: end for 9: end for 10: θGi ← θGg ; 11: for t ∈ {1, ..., T} do 12: for all x, y ∈ Xi do 13: sample z from N(0, 1) 14: θDi ← θDi - η2∇θDi Ldisc (x, y, z) 15: θGi ← θGi - η2∇θGi Lgen (y, z) 16: end for 17: end for 18: end for each 19: Client i sends θGi and θCi to server.

(4), and alternatively minimize the two losses to optimize the generator θGi and discriminator θDi .

Once the local training is completed, each client i sends its generator θGi and classifier θCi to the server for aggregation.

Algorithm 2 Server Aggregation

Input: size of data set |Xi|ni=1 ; clients' generators and classifiers {Gi(·; θGi ),Ci(·; θCi )}ni=1 ; learning rate η3; training iteration T , sample batch size B.

• 1: Server receives {θGi }ni=1 and {θCi }ni=1 from all clients.
• 2: {θGg , θCg } = ∑ni=1 |Xi | ∑ni=1 |Xi| {θGi , θCi }
• 3: for t ∈ {1, ..., T} do
• 4: Sample (z, y), where z ∼ N(0, 1) and y ∼ U(0, c).
• 5: {θGg , θCg } ← {θGg , θCg }- η3∇θGg,Cg LKL (y, z)
• 6: end for
• 7: Server sends θGg and θCg to all clients.

3.3 Server Aggregation

The server utilizes knowledge distillation (KD) [Lin et al., 2020] to perform the aggregation. One major advantage of FEDCG over existing KD methods in FL is that FEDCG does not require the server to access any public data in order to perform distillation.

Figure 3 illustrates the server aggregation while Algorithm 2 describes the detailed procedure. When the server receives generators {Gi}ni=1 and classifiers {Ci}ni=1 uploaded by clients, it initializes parameters of the global generator θGg and global classifier θCg by weighted averaging {θGi }ni=1 and {θCi }ni=1 . For distillation (Algo 2, lines 3-6), the server first generates a mini-batch of training data (z, y), where labels y are sampled from uniform distribution U(0, c) and noises z are sampled from Gaussian distribution N(0, 1). Then, according to (5) the server feeds (z, y) to all generators and calculates class probability distributions Pc(y, z) and Ps(y, z), the former is ensembled from clients' classifiers while the latter is from the global classifier. Next, the server optimizes the global classifier θCg and generator θGg by minimizing the KL divergence between two distributions, according to (6).

where | · | denotes the size of data set, KL indicates Kullback-Leibler divergence and σ is the softmax function. Once the server aggregation is completed, the server dispatches the global generator θGg and global classifier θCg to all clients.

3.4 Privacy Analysis

In the literature, there are a variety of data recovery methods, among which DLG [Zhu and Han, 2020] is able to achieve exact pixel-wise level data revealing. In this work, we consider the semi-honest scenario where the server follows the FL protocol but utilizes DLG to recover original data from a victim client. The sizes of private data can be sent to the server as hyperparameters as assumed in the conventional FL. We evaluate the privacy-preserving capability of FEDCG by comparing the quality of image data recovered in FEDCG, FEDAVG and FEDSPLIT. (7) shows the DLG loss Ldlg for the semi-honest server recovering the real data of victim client i.

where xi is the real data of victim client i while ˜x is the variable to be trained to approximate xi by minimizing DLG loss Ldlg , which is the distance between ∇θLcls (xi) and ∇θLcls (˜x). The former is observed gradients of Lcls (see (1)) w.r.t. model parameters θ for the real data xi, while the latter is estimated gradients for ˜x. For FEDAVG, the server knows the full network of client i, thus θ := θEi,Ci . While for FEDSPLIT, the server only knows the classifier, and thus θ := θCi . Although subsequent research works on DLG generally employs cosine similarity as the loss function, the image reconstruction quality of MSE is more satisfactory for LeNet networks [Geiping et al., 2020].

Similar to FEDSPLIT, FEDCG hides private extractors from the server for protecting privacy. Nonetheless, FEDCG shares clients' generators with the server for aggregating shared knowledge. Thus, FEDCG has auxiliary information on extractors' output distribution estimated by generators. We define the DLG loss for FEDCG as follows:

where ˜E is the estimated extractor whose parameters are not known by the server, and thus it is randomly initialized. The second optimization term of Ldlg FEDCG aligns the statistical information of features between the estimated extractor ˜E of the server and the shared generator of victim client Gi. µc and σc are the mean and standard deviation on each channel c of features generated by Gi. We will quantitatively measure privacy-preserving capabilities of FEDAVG, FEDSPLIT and FEDCG according to (7) and (8) in the next section.

4 Experiments

In this section, we compare the performance of our proposed FEDCG against FL baselines and evaluate the privacypreserving capability of FEDCG.

4.1 Experiment Settings

Model Architecture

LeNet5 [LeCun et al., 1998] is used as the backbone network for image classification tasks in FL system. The first 2 convolutional layers of LeNet are regarded as private extractor, while the latter 3 fully connected layers are regarded as public classifier. Our CGAN architecture is a modified version of DCGAN [Radford et al., 2015], in which the size and stride of convolution kernels are adjusted to match the output dimensions of the extractor and generator.

Datasets

We evaluate model performance of clients on 5 image datasets: FMNIST, CIFAR10, Digit5 [Peng et al., 2019], Office-Caltech10 [Gong et al., 2012], and DomainNet [Peng et al., 2019]. MNIST and CIFAR10 simulate the IID setting

(independent identically distributed). While Digit5, OfficeCaltech10, and DomainNet comprise data from multiple domains, and thus they naturally form the Non-IID setting. Digit5 is a collection of 5 benchmarks for digit recognition, namely MNIST, Synthetic Digits, MNIST-M, SVHN, and USPS. Office-Caltech10 contains 10 Office Supplies from 4 domains: Amazon, DSLR, Webcam, and Caltech. DomainNet comprises of 6 domains: Painting, Clipart, Infograph, Quickdraw, Real and Sketch.

Baselines

We chose 5 FL baselines from two categories of FL methods. The first category includes FEDAVG [McMahan et al., 2017], FEDPROX [Li et al., 2020] and FEDDF [Lin et al., 2020], in which clients share their full networks with the server. The second one includes FEDSPLIT [Gu et al., 2021] and FEDGEN [Zhu et al., 2021], in which clients share only their public classifiers. FEDAVG is the most widely used FL method. FEDPROX introduces a proximal term in the local objective to regularize the local model training. FEDDF utilizes knowledge distillation to aggregate local models on the server leveraging unlabeled public data. FEDSPLIT shares only the public classifier of the local network to protect privacy. FEDGEN employs knowledge distillation to train a global generator, which in turn helps clients train their local networks. In this work, we implement FEDGEN based on FEDSPLIT, in which only the public classifiers of local networks are shared. We also consider the client's local network trained solely based on local data as a baseline and denote it as LOCAL.

Configurations

We perform 100 global communication rounds and 20 local epochs with a batch size of 16. All experiments use the Adam optimizer with a learning rate of 3e-4 and a weight decay of 1e-4. For FEDPROX, we tried proximal term factor in the range of {0.001, 0.01, 0.1, 1} and picked the best one. FEDGEN, FEDDF and FEDCG perform 2000 iterations in the server for model fusion with a batch size of 16.

We consider each domain as a client for Digit5, OfficeCaltech10 and DomainNet except that MNIST and Painting are held out as distillation data for FEDDF. We consider 4and 8-client scenarios for CIFAR10 and consider a 4-client scenario for FMNIST. For FMNIST, CIFAR10, and Digit5, we randomly sample 2000 images for each client as the local training set. For Office-Caltech10 and DomainNet, 50% of the original data of each domain is used as the local training set. We use validation and test datasets on clients to report the best test accuracy over 5 different random seeds. We also leverage diversity loss from [Mao et al., 2019] to improve the stability of the generator.

4.2 Experiment Results

Performance Evaluation

We evaluate FEDCG's performance by first comparing its averaged clients' accuracy with those of 6 baselines on 5 datasets for both IID and non-IID settings. Table 1 shows that FEDCG achieves the best accuracy in 4 out of 6 scenarios, demonstrating its competitive performance. Specifically, FEDCG achieves the best accuracy in all 3 non-IID scenarios. In particular, it outperforms the-next-best-performing FEDPROX by 4.35% on Office. In IID scenarios, FEDAVG, FEDPROX and FEDDF have an edge in that they aggregate full local networks while there is no negative transfer effect caused by data heterogeneity. As a result, they perform better than FEDCG overall, on CIFAR10 particularly. However, they are vulnerable to DLG attacks, discussed in the next section.

Because the goal of FEDCG is to improve the performance of each client's personalized local network validating on local test data, we further compare the accuracy gains between FEDCG and 5 FL baselines over the LOCAL. In IID scenarios, all FL methods outperform LOCAL on all clients by large margins, as shown in Figures 4(a) and 4(b). Particularly, FEDCG performs best on FMNIST(4) while FEDPROX performs best on CIFAR10(8). In non-IID scenarios, while no FL method can beat LOCAL on every client across all 3

non-IID datasets, FEDCG achieves the best result such that it outperforms LOCAL on 12 out of 13 clients, as shown in Figure 4(c), 4(d) and 4(e). FEDAVG, FEDPROX and FEDDF are not excel in non-IID scenarios as they are in IID scenarios because the average-based global model may be far from client's local optima [Li et al., 2021]. Besides, the distillation dataset leveraged by FEDDF is from a different domain than those of clients, which may have negative impacts on the performance of aggregated global model.

Privacy Evaluation

We calculate Peak Signal-to-Noise Ratio (PSNR) to measure the similarity between original images and images recovered from DLG. PSNR is an objective standard for image evaluation, and it is defined as the logarithm of the ratio of the squared maximum value of RGB image fluctuation over MSE between two images. The higher the PSNR score, the higher the similarity between the two images. We also apply differential privacy (DP) to FEDAVG by adding Gaussian noises to shared gradients. We experiment with two noise levels, σ2 = 0.1 and σ2 = 0.001.

Table 2 compares FEDCG with FEDSPLIT and FEDAVG in terms of model performance measured by accuracy and privacy-preserving capability measured by PSNR between the ground-truth image and the recovered one using DLG. Compared to FEDAVG and FEDSPLIT, FEDCG achieves competitive accuracies for all three datasets. However, FEDAVG has much higher risk of leaking data information (high PSNR value). Although the data privacy could be better protected by introducing DP to FEDAVG, there is a significant drop (over 20%) in the model performance. On the other hand, FEDSPLIT and FEDCG effectively protect the data privacy (low PSNR value). While achieving similar privacy protection level, FEDCG demonstrates better model accuracies than those of FEDSPLIT for all three datasets by at least 2%.

5 Conclusion

We propose FEDCG, a novel federated learning method that leverages conditional GAN to protect data privacy while maintaining competitive model performance. FEDCG decomposes each client's local network into a private extractor and a public classifier, and keeps the extractor local to protect privacy. It shares clients' generators with the server to aggregate shared knowledge aiming to enhance the performance of clients' local networks. Experiments show that FEDCG has a high-level privacy-preserving capability and can achieve competitive model performance.

Acknowledgments

This work is partially supported by the National Key Research and Development Program of China under grant [2018AAA0101100], the Special Funds for Central Government Guiding Development of Local Science & Technology under grant [2020B1515310019] and the Basic Research Project of Guangzhou, China under grant [202002030300].