Federated learning (FL) provides a variety of privacy advantages by allowing clients to collaboratively train a model without sharing their private data. However, recent studies have shown that private information can still be leaked through shared gradients. To further minimize the risk of privacy leakage, existing defenses usually require clients to locally modify their gradients (e.g., differential privacy) prior to sharing with the server. While these approaches are effective in certain cases, they regard the entire data as a single entity to protect, which usually comes at a large cost in model utility. In this paper, we seek to reconcile utility and privacy in FL by proposing a user-configurable privacy defense, RecUP-FL, that can better focus on the user-specified sensitive attributes while obtaining significant improvements in utility over traditional defenses. Moreover, we observe that existing inference attacks often rely on a machine learning model to extract the private information (e.g., attributes). We thus formulate such a privacy defense as an adversarial learning problem, where RecUP-FL generates slight perturbations that can be added to the gradients before sharing to fool adversary models. To improve the transferability to un-queryable black-box adversary models, inspired by the idea of meta-learning, RecUP-FL forms a model zoo containing a set of substitute models and iteratively alternates between simulations of the white-box and the black-box adversarial attack scenarios to generate perturbations. Extensive experiments on four datasets under various adversarial settings (both attribute inference attack and data reconstruction attack) show that RecUP-FL can meet user-specified privacy constraints over the sensitive attributes while significantly improving the model utility compared with state-of-the-art privacy defenses.

翻译：联邦学习（FL）允许客户端在不共享私有数据的情况下协同训练模型，从而提供多种隐私优势。然而，近期研究表明，私有信息仍可能通过共享的梯度泄露。为进一步降低隐私泄露风险，现有防御机制通常要求客户端在将梯度共享给服务器前进行本地修改（例如差分隐私）。尽管这些方法在特定场景下有效，但它们将整个数据视为单一保护对象，通常会导致模型效用大幅降低。本文通过提出一种用户可配置的隐私防御方法RecUP-FL，旨在协调联邦学习中的效用与隐私，该方法能更好地聚焦用户指定的敏感属性，同时相较于传统防御显著提升模型效用。此外，我们观察到现有推理攻击常依赖机器学习模型提取私有信息（如属性）。因此，我们将此类隐私防御形式化为对抗学习问题，其中RecUP-FL在梯度共享前生成微小的扰动以欺骗攻击者模型。受元学习思想启发，为提升对不可查询的黑盒攻击者模型的迁移性，RecUP-FL构建了一个包含若干替代模型的模型库，并通过交替模拟白盒与黑盒对抗攻击场景迭代生成扰动。在四个数据集上针对多种对抗场景（包括属性推理攻击和数据重建攻击）的广泛实验表明，RecUP-FL能在满足用户对敏感属性指定的隐私约束的同时，相较于现有最优隐私防御显著提升模型效用。