Federated learning aims to protect data privacy by collaboratively learning a model without sharing private data among clients. Unlike traditional parameter-based FL methods that exchange model weights or gradients during training, emerging logit-based FL approaches share model outputs (logits) on public data. This strategy promotes model heterogeneity, reduces communication overhead, and enhances clients' privacy. However, the potential privacy risks associated with these logit-based methods have been largely overlooked. This research presents the first theoretical and empirical analysis of a hidden privacy risk in logit-based FL methods - the risk that a semi-honest server (adversary) may learn clients' private models from logits. To quantify and address this threat, we develop the Adaptive Model Stealing Attack (AdaMSA) by leveraging historical logits during training. Notably, we observe that this inherent privacy risk persists even when public data is unrelated to private data, emphasizing the urgency to address privacy vulnerabilities in logit-based FL methods. Moreover, our theoretical analysis establishes the bounds of this privacy risk. We then propose a simple but effective defense strategy that perturbs the transmitted logits in the direction that minimizes the privacy risk while maximally preserving the training performance. The experimental results validate our analysis and demonstrate the effectiveness of AdaMSA and our defense strategy.

翻译：联邦学习旨在通过协作学习模型来保护数据隐私，且无需在客户端之间共享私有数据。与传统的交换模型权重或梯度的基于参数的联邦学习方法不同，新兴的基于逻辑值的联邦学习方法在公共数据上共享模型输出（逻辑值）。这种策略促进了模型异构性，减少了通信开销，并增强了客户端的隐私。然而，这些基于逻辑值的方法中潜在的隐私风险在很大程度上被忽视了。本研究首次从理论和实证角度分析了基于逻辑值联邦学习方法中隐藏的隐私风险——即半诚实服务器（对手）可能从逻辑值中学习到客户端的私有模型的风险。为量化并应对这一威胁，我们利用训练过程中的历史逻辑值开发了自适应模型窃取攻击（AdaMSA）。值得注意的是，我们观察到即使公共数据与私有数据无关，这种固有的隐私风险依然存在，这凸显了解决基于逻辑值联邦学习方法中隐私漏洞的紧迫性。此外，我们的理论分析建立了这种隐私风险的边界。随后，我们提出了一种简单但有效的防御策略，该策略沿最小化隐私风险同时最大程度保持训练性能的方向扰动传输的逻辑值。实验结果验证了我们的分析，并证明了AdaMSA及我们防御策略的有效性。