Abstract:

Federated learning mitigates the risks of centralized data storage through distributed training, yet remains vulnerable to malicious clients exploiting GAN attacks to steal private data. Traditional defense methods such as differential privacy and encryption mechanisms suffer from challenges in balancing model performance and privacy effectiveness or incur high computational costs. To address the threat of GAN attacks in federated learning for image recognition tasks, this paper proposes a privacy enhancement method based on Rényi differential privacy (RDP) to improve data privacy. The serial composition mechanism of Rényi differential privacy enables the privacy budget growth rate in multi-round iterations to transition from the linear scaling of traditional differential privacy to sublinear scaling, effectively reducing the amount of noise added. Thus, the method leverages the tight noise composition properties of RDP by incorporating gradient clipping based on weight equilibrium and optimized Gaussian noise injection into client-side gradient updates. This approach enables differential privacy-preserving computations, effectively reducing privacy leakage risks while balancing model utility. Experiments show that the method realizes local data privacy protection and enhances the privacy protection ability of the model under the premise that the degree of impact on the model’s global accuracy remains acceptable, so as to effectively resist GAN attacks and ensure the privacy of image data.

Key words: federated learning, GAN attacks, differential privacy, privacy enhancement