FedCG: Leverage Conditional GAN for Protecting Privacy and Maintaining Competitive Performance in Federated Learning

TL;DR

FedCG tackles privacy risks in federated learning by keeping each client’s private extractor local while sharing a generator for knowledge aggregation, enabling a global generator $G_g$ and global classifier $C_g$ learned via knowledge distillation without public data. The method uses a two-stage client update with losses $L^{cls}$ and $L^{mse}$ (weighted by a ramped parameter $\gamma$) and a cGAN-based generator update, promoting alignment between local representations and the global generator. A privacy-aware server aggregation and a dedicated DLG-based privacy analysis show FedCG can resist gradient-inversion attacks while maintaining competitive accuracy across IID and non-IID settings, outperforming several FL baselines in non-IID scenarios. The results indicate FedCG’s practical potential for privacy-preserving, high-performance FL, with future work aimed at deeper networks and formal privacy guarantees.

Abstract

Federated learning (FL) aims to protect data privacy by enabling clients to build machine learning models collaboratively without sharing their private data. Recent works demonstrate that information exchanged during FL is subject to gradient-based privacy attacks, and consequently, a variety of privacy-preserving methods have been adopted to thwart such attacks. However, these defensive methods either introduce orders of magnitude more computational and communication overheads (e.g., with homomorphic encryption) or incur substantial model performance losses in terms of prediction accuracy (e.g., with differential privacy). In this work, we propose $\textsc{FedCG}$, a novel federated learning method that leverages conditional generative adversarial networks to achieve high-level privacy protection while still maintaining competitive model performance. $\textsc{FedCG}$ decomposes each client's local network into a private extractor and a public classifier and keeps the extractor local to protect privacy. Instead of exposing extractors, $\textsc{FedCG}$ shares clients' generators with the server for aggregating clients' shared knowledge, aiming to enhance the performance of each client's local networks. Extensive experiments demonstrate that $\textsc{FedCG}$ can achieve competitive model performance compared with FL baselines, and privacy analysis shows that $\textsc{FedCG}$ has a high-level privacy-preserving capability. Code is available at https://github.com/yankang18/FedCG

Figures (6)

• Figure 1: Overview of FedCG.
• Figure 2: Two-stage client update. (a) Classification network update. (b) Generative network update.
• Figure 3: Server aggregation. The server generates Gaussian noise $z$ and class label $y$ as the inputs of clients' $\{G_i\}_{i=1}^n$ and global $G_g$, and it optimizes $\theta_{C_g}$ and $\theta_{C_g}$ by minimizing the KL divergence between the distribution ensembled from $\{C_i\}_{i=1}^n$ and the one outputted from $C_g$.
• Figure 4: We demonstrate the competitive performance of FedCG on 5 datasets: Digit5 is a collection of 5 benchmarks for digit recognition, namely MNIST, Synthetic Digits, MNIST-M, SVHN, and USPS. Office-Caltech10 contains 10 Office Supplies from 4 domains: Amazon, DSLR, Webcam, and Caltech. DomainNet comprises of 6 domains: Painting, Clipart, Infograph, Quickdraw, Real and Sketch. FMNIST and CIFAR10 are widely used image datasets.
• Figure 5: Accuracy gains achieved by FedAvg, FedProx, FedDF, FedSplit, and FedCG (red) over local of each client on all 5 datasets. The vertical axis is the performance difference in terms of accuracy (%). A positive (negative) gain means FL methods achieves better (worse) than the Local model.