DictPFL: Efficient and Private Federated Learning on Encrypted Gradients

TL;DR

DictPFL tackles the privacy-utility trade-off in gradient-based federated learning by enabling full gradient encryption with dramatically reduced ciphertext workloads. It achieves this through a two-module design: DePE, which factors trainable weights into a fixed global dictionary $D$ and a per-client lookup table $T$ so that only $T$ is encrypted, and PrME, which uses principled, history-guided pruning with temporal stability and reactivation to minimize encrypted parameters. Empirical results across vision and NLP tasks show 402–748× communication reductions and 28–65× training speedups over fully encrypted FL, while outperforming selective encryption baselines by 51–155× in overhead and 4–19× in speed, and maintaining accuracy with privacy guarantees close to plaintext FL. The work demonstrates that HE-based private federated learning can be practical at scale, enabling secure collaboration without exposing plaintext gradients, and provides public code for reproducibility.

Abstract

Federated Learning (FL) enables collaborative model training across institutions without sharing raw data. However, gradient sharing still risks privacy leakage, such as gradient inversion attacks. Homomorphic Encryption (HE) can secure aggregation but often incurs prohibitive computational and communication overhead. Existing HE-based FL methods sit at two extremes: encrypting all gradients for full privacy at high cost, or partially encrypting gradients to save resources while exposing vulnerabilities. We present DictPFL, a practical framework that achieves full gradient protection with minimal overhead. DictPFL encrypts every transmitted gradient while keeping non-transmitted parameters local, preserving privacy without heavy computation. It introduces two key modules: Decompose-for-Partial-Encrypt (DePE), which decomposes model weights into a static dictionary and an updatable lookup table, only the latter is encrypted and aggregated, while the static dictionary remains local and requires neither sharing nor encryption; and Prune-for-Minimum-Encrypt (PrME), which applies encryption-aware pruning to minimize encrypted parameters via consistent, history-guided masks. Experiments show that DictPFL reduces communication cost by 402-748$\times$ and accelerates training by 28-65$\times$ compared to fully encrypted FL, while outperforming state-of-the-art selective encryption methods by 51-155$\times$ in overhead and 4-19$\times$ in speed. Remarkably, DictPFL's runtime is within 2$\times$ of plaintext FL, demonstrating for the first time, that HE-based private federated learning is practical for real-world deployment. The code is publicly available at https://github.com/UCF-ML-Research/DictPFL.

Figures (9)

• Figure 1: (a) Prior HE-based FL jin2023fedml encrypts only deemed sensitive gradients. The less-sensitive weights are shared in plaintext, which may lead to privacy concerns. (b) In contrast, our DictPFL minimizes encryption while ensuring privacy guarantees through Decompose-for-Partial-Encrypt (DePE) and Prune-for-Minimum-Encrypt (PrME). DePE decomposes gradients into a frozen dictionary and a trainable lookup table, with only the lookup table being encrypted and shared for aggregation. PrME further prunes the lookup table parameters on the client side to reduce encryption costs.
• Figure 2: Time breakdown for training a ViT on GTSRB.
• Figure 3: Representing the weight matrix $W$ with dictionary $D$ and lookup table $T$.
• Figure 4: (a) As training progresses, parameters that initially have large gradients gradually transition to having smaller ones. (b) Concurrently, the number of parameters with substantial gradients decreases significantly. (c) An example of failed aggregation caused by different pruning locations on clients A and B.
• Figure 5: Evolution of a parameter’s global gradients under different pruning strategies. Green background indicates the parameter is pruned (excluded from aggregation), while gray background indicates the opposite. Larger green areas reflect more overhead reduction. Closer alignment of gradient trends with the baseline (a) signifies preserved convergence performance.