An empirical analysis of image augmentation against model inversion attack in federated learning

Federated Learning (FL) is a technology that facilitates a sophisticated way to train distributed data. As the FL does not expose sensitive data in the training process, it was considered privacy-safe deep learning. However, a few recent studies proved that it is possible to expose the hidden data b...

Full description

Saved in:
Bibliographic Details
Published in:Cluster computing 2023-02, Vol.26 (1), p.349-366
Main Authors: Shin, Seunghyeon, Boyapati, Mallika, Suo, Kun, Kang, Kyungtae, Son, Junggab
Format: Article
Language:English
Subjects:
Accuracy
Automation
Collaboration
Computer Communication Networks
Computer Science
Datasets
Deep learning
Defense
Empirical analysis
Exposure
Federated learning
Machine learning
Neural networks
Noise
Operating Systems
Optimization
Privacy
Processor Architectures
Tradeoffs
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Federated Learning (FL) is a technology that facilitates a sophisticated way to train distributed data. As the FL does not expose sensitive data in the training process, it was considered privacy-safe deep learning. However, a few recent studies proved that it is possible to expose the hidden data by exploiting the shared models only. One common solution for the data exposure is differential privacy that adds noise to hinder such an attack, however, it inevitably involves a trade-off between privacy and utility. This paper demonstrates the effectiveness of image augmentation as an alternative defense strategy that has less impact of the trade-off. We conduct comprehensive experiments on the CIFAR-10 and CIFAR-100 datasets with 14 augmentations and 9 magnitudes. As a result, the best combination of augmentation and magnitude for each image class in the datasets was discovered. Also, our results show that a well-fitted augmentation strategy can outperform differential privacy.
ISSN:1386-7857
1573-7543
DOI:10.1007/s10586-022-03596-1