Communication-efficient privacy-preserving federated learning method

doi:10.3969/j.issn.1671-1122.2026.10.008

Abstract

Abstract:

Plaintext transmission of model updates in federated large language model fine-tuning may lead to privacy leakage, whereas full homomorphic encryption incurs substantial communication and computational overhead. To address these issues, this paper proposed a communication-efficient privacy-preserving federated learning method. It should be noted that data heterogeneity does not change the computational complexity of a single CKKS encryption or decryption operation. Its impact was mainly reflected in the inconsistency of sensitive parameter locations and LoRA rank structures identified by different clients, which enlarged the ciphertext index set to be aligned and the reconstruction matrix used for aggregation, thereby indirectly increasing encryption, communication, and matrix decomposition overhead. To address this issue, centered kernel alignment (CKA) was first employed to quantify the representational redundancy of model layers. Under a unified upper bound on the number of encrypted columns per layer, the encryption quotas of redundant layers were adaptively reduced to eliminate unnecessary ciphertexts. Then, a three-way hybrid negotiation mechanism based on order-preserving encryption was designed to integrate public high-frequency columns, globally highly sensitive columns, and client-specific long-tail columns within fixed layer-wise quotas, thereby achieving ciphertext index alignment. Finally, CKKS-based aggregation was performed on the selected sensitive subset, and randomized singular value decomposition (RSVD) was adopted to accelerate the low-rank reconstruction of heterogeneous LoRA updates. Experimental results demonstrate that the proposed method effectively reduces communication and computational overhead while maintaining model utility. Ablation experiments demonstrate that the CKA-based layer-wise quota mechanism effectively reduces communication overhead caused by redundant encryption, the three-way hybrid negotiation mechanism alleviates ciphertext expansion under heterogeneous data distributions, and the RSVD-based reconstruction method significantly reduces the computational overhead of heterogeneous LoRA aggregation. In terms of privacy protection, no successful inversion attacks are observed when the encryption ratio reaches 0.150% or higher under the DAGER attack samples and attack configuration used in this study.

Key words: federated learning, large language model, homomorphic encryption, communication overhead

CLC Number:

TP309

Han Siyuan, Miao Yinbin, Zhang Weibin, Liu Shuying, Liu Shuqin. Communication-efficient privacy-preserving federated learning method[J]. Netinfo Security, 2026, 26(10): 1616-1635.

Figures/Tables 10

符号	含义
$K,{{C}_{t}},{{C}_{i}}$	客户端总数、第$t$轮参与客户端集合及第$i$个客户端
${{D}_{i}},\left\| {{D}_{i}} \right\|$	客户端${{C}_{i}}$的本地数据集及其样本数
${{D}_{val}}$	用于提取层级激活并计算CKA/Wanda指标的本地校准集
$t,T$	当前通信轮及总通信轮数
$L,l$	LoRA层数及层索引
${{r}_{i}}$	客户端${{C}_{i}}$使用的LoRA秩
${{W}^{\left( t \right)}},\text{ }\!\!\Delta\!\!\text{ }W_{i}^{\left( t \right)}$	第$t$轮全局模型参数及客户端模型更新
$A_{i,l}^{\left( t \right)},B_{i,l}^{\left( t \right)}$	客户端${{C}_{i}}$在第$t$轮第$l$层的LoRA因子
$X_{in,i,l}^{\left( t \right)}$	输入第$l$层LoRA-A分支的校准激活
$C_{i,l}^{\left( t \right)},S_{i,l}^{\left( t \right)}$	客户端${{C}_{i}}$的CKA冗余度及本地层级重要性得分
$\bar{S}_{l}^{(t)},k_{l}^{\left( t \right)}$	参与客户端层级得分的平均值及服务器据此确定的第$t$轮统一层级配额
${{k}_{uni}},{{K}_{\text{max}}}$	均匀方案的每层加密列数上限及名义总加密列数上限$L{{k}_{\text{uni}}}$
$\text{ }\!\!\Omega\!\!\text{ }_{i,l}^{\left( t \right)}$	基于权重幅值与输入激活范数计算的Wanda敏感度
$\mathcal{E}_{i,l}^{\left( t \right)},P_{i,l}^{\left( t \right)}$	第$l$层加密索引集合及其未加密补集
$I_{global,l}^{\left( t \right)}$	三元协商得到的第$l$层全局加密索引集合
$[c]_{i}^{\left( t \right)},p_{i}^{\left( t \right)}$	客户端${{C}_{i}}$上传的CKKS密文流及未加密更新流
${{c}_{e}},{{c}_{p}},C_{ct}^{\left( t \right)}$	有效单位密文代价、单位明文标量代价及第$t$轮密文规模
${{N}_{poly}},s,{{B}_{ct}},{{B}_{pt}}$	CKKS多项式模次数、SIMD槽数、单个序列化密文字节数及明文标量字节数
$B_{meta,i}^{\left( t \right)},B_{up,i}^{\left( t \right)}$	客户端${{C}_{i}}$第$t$轮的元数据字节数及上行通信字节数
$m_{i}^{\left( t \right)},d_{i}^{\left( t \right)}$	客户端第$t$轮加密标量数及可训练标量总数
${{\lambda }_{c}},{{\lambda }_{s}},{{\lambda }_{p}}$	三元协商中公共频次、全局敏感度和客户端长尾的列数配额
${{q}_{over}},{{p}_{rsvd}}$	RSVD过采样维数及幂迭代次数
${{\alpha }_{\text{max}}},\alpha _{act}^{\left( t \right)}$	名义加密比例上限及第$t$轮实测加密比例

References 42

[1]	Li Heju, Wang Rui, Wu Jun, et al. Reconfigurable intelligent surface empowered federated edge learning with statistical CSI[J]. IEEE Transactions on Wireless Communications, 2024, 23(6): 6595-6608.
[2]	Xu Liang, Zhu Lei, Wu Yaotong, et al. SuperCLUE-Fin: graded fine-grained analysis of Chinese LLMs on diverse financial tasks and applications[PP/OL]. V1. arXiv (2024-04-29)[2026-07-10]. https://doi.org/10.48550/arXiv.2404.19063.
[3]	Li Heju, Wang Rui, Jiang Mingyang, et al. STAR-RIS-empowered heterogeneous federated edge learning with flexible aggregation[J]. IEEE Internet of Things Journal, 2025, 12(14): 28374-28389.
[4]	Zhao Yue, Li Meng, Lai Liangzhen, et al. Federated learning with non-IID data[PP/OL]. V2. arXiv (2022-07-21)[2026-07-10]. https://doi.org/10.48550/arXiv.1806.00582.
[5]	Li Heju, Wang Rui, Wu Jun, et al. Federated edge learning via reconfigurable intelligent surface with one-bit quantization[C]// 2022 IEEE Global Communications Conference. New York: IEEE, 2022: 1055-1060.
[6]	Hu E J, Shen Yelong, Wallis P, et al. LoRA: low-rank adaptation of large language models[PP/OL]. V2. arXiv (2021-10-16)[2026-07-10]. https://doi.org/10.48550/arXiv.2106.09685.
[7]	Stich S U, Cordonnier J B, Jaggi M. Sparsified SGD with memory[PP/OL]. V2. arXiv (2018-11-28)[2026-07-10]. https://doi.org/10.48550/arXiv.1809.07599.
[8]	Lin Yujun, Han Song, Mao Huizi, et al. Deep gradient compression: reducing the communication bandwidth for distributed training[PP/OL]. V3. arXiv (2020-06-23)[2026-07-10]. https://doi.org/10.48550/arXiv.1712.01887.
[9]	Zhu Ligeng, Liu Zhijian, Han Song. Deep leakage from gradients[C]// Advances in Neural Information Processing Systems. Red Hook: Curran Associates, 2019: 14774-14784.
[10]	Geiping J, Bauermeister H, Dröge H, et al. Inverting gradients—how easy is it to break privacy in federated learning?[C]// Advances in Neural Information Processing Systems. Red Hook: Curran Associates, 2020: 16937-16947.
[11]	Wang Shiqiang, Tuor T, Salonidis T, et al. Adaptive federated learning in resource constrained edge computing systems[J]. IEEE Journal on Selected Areas in Communications, 2019, 37(6): 1205-1221.
[12]	Hu Chenghao, Li Baochun. MaskCrypt: federated learning with selective homomorphic encryption[J]. IEEE Transactions on Dependable and Secure Computing, 2025, 22(1): 221-233.
[13]	Liu Jianmin, Yan Li, Li Borui, et al. SHE-LoRA: selective homomorphic encryption for federated tuning with heterogeneous LoRA[PP/OL]. V2. arXiv (2026-02-21)[2026-07-10]. https://doi.org/10.48550/arXiv.2505.21051.
[14]	Sun Youbang, Li Zitao, Li Yaliang, et al. Improving LoRA in privacy-preserving federated learning[PP/OL]. V1. arXiv (2024-03-18)[2026-07-10]. https://doi.org/10.48550/arXiv.2403.12313.
[15]	Babakniya S, Elkordy A R, Ezzeldin Y H, et al. SLoRA: federated parameter efficient fine-tuning of language models[PP/OL]. V1. arXiv (2023-08-12)[2026-07-10]. https://doi.org/10.48550/arXiv.2308.06522.
[16]	Li Tian, Sahu A K, Zaheer M, et al. Federated optimization in heterogeneous networks[J]. Proceedings of Machine Learning and Systems, 2020(2): 429-450.
[17]	Karimireddy S P, Kale S, Mohri M, et al. SCAFFOLD: stochastic controlled averaging for federated learning[C]// The 37th International Conference on Machine Learning. Cambridge: PMLR, 2020: 5132-5143.
[18]	Wang Jianyu, Liu Qinghua, Liang Hao, et al. Tackling the objective inconsistency problem in heterogeneous federated optimization[C]// Advances in Neural Information Processing Systems. Red Hook: Curran Associates, 2020: 7611-7623.
[19]	Cho Y J, Liu Luyang, Xu Zheng, et al. Heterogeneous LoRA for federated fine-tuning of on-device foundation models[C]// The 2024 Conference on Empirical Methods in Natural Language Processing. Stroudsburg: ACL, 2024: 12903-12913.
[20]	Bai Jiamu, Chen Daoyuan, Qian Bingchen, et al. Federated fine-tuning of large language models under heterogeneous tasks and client resources[PP/OL]. V2. arXiv (2024-05-30)[2026-07-10]. https://doi.org/10.48550/arXiv.2402.11505.
[21]	Yan Yunlu, Feng Chunmei, Zuo Wangmeng, et al. Federated residual low-rank adaptation of large language models[C]// The 13th International Conference on Learning Representations. San Diego: ICLR, 2025: 30657-30681.
[22]	Wei Kang, Li Jun, Ding Ming, et al. Federated learning with differential privacy: algorithms and performance analysis[J]. IEEE Transactions on Information Forensics and Security, 2020, 15: 3454-3469.
[23]	Kaminaga H, Awaysheh F, Alawadi S, et al. MPCFL: towards multi-party computation for secure federated learning aggregation[C]// The 16th IEEE/ACM International Conference on Utility and Cloud Computing. New York: ACM, 2023: 1-10.
[24]	Bonawitz K A, Ivanov V, Kreuter B, et al. Practical secure aggregation for privacy-preserving machine learning[C]// The 2017 ACM SIGSAC Conference on Computer and Communications Security. New York: ACM, 2017: 1175-1191.
[25]	Zhang Chengliang, Li Suyi, Xia Junming, et al. BatchCrypt: efficient homomorphic encryption for cross-silo federated learning[C]// 2020 USENIX Annual Technical Conference. Berkeley: USENIX, 2020: 493-506.
[26]	Jin Weizhao, Yao Yuhang, Han Shanshan, et al. FedML-HE: an efficient homomorphic-encryption-based privacy-preserving federated learning system[PP/OL]. V3. arXiv (2024-06-17)[2026-07-10]. https://doi.org/10.48550/arXiv.2303.10837.
[27]	Kornblith S, Norouzi M, Lee H, et al. Similarity of neural network representations revisited[C]// The 36th International Conference on Machine Learning. Cambridge: PMLR, 2019: 3519-3529.
[28]	McMahan H B, Moore E, Ramage D, et al. Communication-efficient learning of deep networks from decentralized data[C]// The 20th International Conference on Artificial Intelligence and Statistics. Cambridge: PMLR, 2017: 1273-1282.
[29]	Zheng Xiawu, Fei Xiang, Zhang Lei, et al. Neural architecture search with representation mutual information[C]// Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. New York: IEEE/CVF, 2022: 11912-11921.
[30]	Tishby N, Pereira F C, Bialek W. The information bottleneck method[C]// The 37th Annual Allerton Conference on Communication, Control, and Computing. Monticello: University of Illinois, 1999: 368-377.
[31]	Halko N, Martinsson P G, Tropp J A. Finding structure with randomness: probabilistic algorithms for constructing approximate matrix decompositions[J]. SIAM Review, 2011, 53(2): 217-288.
[32]	Cheon J H, Kim A, Kim M, et al. Homomorphic encryption for arithmetic of approximate numbers[C]// Advances in Cryptology—ASIACRYPT 2017. Heidelberg: Springer, 2017: 409-437.
[33]	Petrov I, Dimitrov D I, Baader M, et al. DAGER: exact gradient inversion for large language models[PP/OL]. V2. arXiv (2024-11-13)[2026-07-10]. https://doi.org/10.48550/arXiv.2405.15586.
[34]	Boldyreva A, Chenette N, Lee Y, et al. Order-preserving symmetric encryption[C]// Advances in Cryptology—EUROCRYPT 2009. Heidelberg: Springer, 2009: 224-241.
[35]	Sun Mingjie, Liu Zhuang, Bair A, et al. A simple and effective pruning approach for large language models[PP/OL]. V3. arXiv (2024-05-06)[2026-07-10]. https://doi.org/10.48550/arXiv.2306.11695.
[36]	Geng Xinyang, Liu Hao. OpenLLaMA: an open reproduction of LLaMA[EB/OL]. [2026-07-10]. https://github.com/openlm-research/open_llama.
[37]	Mishra S, Khashabi D, Baral C, et al. Cross-task generalization via natural language crowdsourcing instructions[C]// The 60th Annual Meeting of the Association for Computational Linguistics. Stroudsburg: ACL, 2022: 3470-3487.
[38]	Maas A L, Daly R E, Pham P T, et al. Learning word vectors for sentiment analysis[C]// The 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies. Stroudsburg: ACL, 2011: 142-150.
[39]	Benaissa A, Retiat B, Cebere B, et al. TenSEAL: a library for encrypted tensor operations using homomorphic encryption[PP/OL]. V2. arXiv (2021-04-28)[2026-07-10]. https://doi.org/10.48550/arXiv.2104.03152.
[40]	Beutel D J, Topal T, Mathur A, et al. Flower: a friendly federated learning research framework[PP/OL]. V5. arXiv (2022-03-05)[2026-07-10]. https://doi.org/10.48550/arXiv.2007.14390.
[41]	Hendrycks D, Burns C, Basart S, et al.Measuring massive multitask language understanding[PP/OL]. V1. arXiv (2020-09-07)[2026-07-10]. https://doi.org/10.48550/arXiv.2009.03300.
[42]	Wang A, Singh A, Michael J, et al. GLUE: a multi-task benchmark and analysis platform for natural language understanding[C]// The 2018 EMNLP Workshop BlackboxNLP:Analyzing and Interpreting Neural Networks for NLP. Stroudsburg: ACL, 2018: 353-355.

方案	异构秩	隐私保护	层级相关性	选择加密
MaskCrypt^[12]	×	Paillier同态加密	•	×
SHE-LoRA^[13]	×	CKKS同态加密	•	×
FFA-LoRA^[14]	•	差分隐私	•	•
SLoRA^[15]	•	•	•	•
HeterLoRA^[19]	×	•	•	•
NbAFL^[22]	•	差分隐私	•	•
MPCFL^[23]	×	多方安全计算	•	•
本文方法	×	CKKS同态加密	×	×

秩配置	方法	PPL	MMLU	ROUGE-L F1
无异构(6,6,6,6)	MaskCrypt	7.136±0.895	28.233%±?.???%	69.919%±?.???%
	SHE-LoRA	7.021±0.405	28.763%±?.???%	70.574%±?.???%
	CKA-LoRA	7.018±0.203	29.010%±?.???%	70.931%±?.???%
轻度异构 (2,4,6,8)	MaskCrypt	7.284±0.912	28.041%±?.???%	69.672%±?.???%
	SHE-LoRA	7.146±0.431	28.5125±?.???%	70.342%±?.???%
	CKA-LoRA	7.108±0.224	28.842%±?.???%	70.716%±?.???%
中度异构(2,8,16,32)	MaskCrypt	7.561±0.974	27.684%±?.???%	69.214%±?.???%
	SHE-LoRA	7.362±0.462	28.207%±?.???%	69.981%±?.???%
	CKA-LoRA	7.251±0.247	28.621%±?.???%	70.421%±?.???%
高度异构(2,8,32,64)	MaskCrypt	7.892±1.086	27.201%±?.???%	68.731%±?.???%
	SHE-LoRA	7.648±0.508	27.842%±?.???%	69.562%±?.???%
	CKA-LoRA	7.431±0.286	28.394%±?.???%	70.083%±?.???%

消融实验	PPL	MMLU	实际加密比例	每轮密文量/MB	每轮聚合时间/s
A0	8.326± 1.026	26.23%± 1.22%	0.2392%	562.06	7.73±4.84
A1	8.331± 1.047	25.61%± 0.55%	0.2969%	697.63	11.74±0.85
A2	8.307± 1.051	25.00%± 0.46%	1.2889%± 0.0039%	3028.68± 9.08	12.54±0.49
A3	8.338± 1.056	26.40%± 0.92%	0.2392%	562.06	1993.10±50.99

加密列数	加密比例	ROUGE-L F1	Token恢复率	攻击成功率
0	0	71.830%±?.???%	56.600%±?.???%	78.380%±?.???%
1	0.015%	6.780%±?.???%	4.650%±?.???%	3.700%±?.???%
3	0.045%	1.010%±?.???%	0.547%±?.???%	0.842%±?.???%
10	0.150%	0	0	0
20	0.300%	0	0	0
32	0.500%	0	0	0
64	1.000%	0	0	0