Technical Summary: FinP: Fairness-in-Privacy in Federated Learning by Addressing Disparities in Privacy Risk

1. Problem Statement

Federated Learning (FL) mitigates the risks of mass data centralization but fails to ensure equitable privacy protection across all participating clients. In human-centric FL environments, statistical heterogeneity (non-IID data) leads to an inequitable distribution of privacy risks. Specifically, clients with unique or outlier data distributions (e.g., individuals with specific physical disabilities in Human Activity Recognition) are prone to local overfitting. This overfitting causes their local models to memorize unique data points, making them disproportionately vulnerable to Source Inference Attacks (SIA).

Unlike Membership Inference Attacks (MIA), which determine if a record was used in training, SIA identifies the specific client who contributed that record. This breaks pseudonymity by linking sensitive data to a real-world context (device or location). Existing privacy defenses, such as Differential Privacy (DP), often inject uniform noise that degrades global utility without resolving the disparity in per-client exposure; in some cases, they exacerbate unfairness by penalizing well-represented clients while failing to mask the distinct updates of skewed clients. The paper identifies a critical gap: the lack of a framework that formalizes and enforces fairness-in-privacy, ensuring no single group bears a disproportionate burden of privacy vulnerability.

2. Methodology: The FinP Framework

FinP is a novel framework designed to operationalize fairness-in-privacy by addressing both the symptoms (unequal risk aggregation) and root causes (local overfitting) of privacy disparity. It employs a closed-loop, two-pronged defense strategy involving server-side and client-side interventions.

2.1 Threat Model

The framework operates under an "honest-but-curious" server assumption. The server faithfully executes the FL protocol but attempts to infer sensitive client information from model updates and curvature metrics. The primary threat is a two-stage attack:

1. Membership Inference Attack (MIA): Determining if a target data point $x$ belongs to the global training set.
2. Source Inference Attack (SIA): If $x$ is confirmed as part of the training set, identifying the specific client $C_i$ that generated it.

2.2 Client-Side Intervention: Collaborative Overfitting Reduction

To address the root cause of vulnerability (local overfitting), FinP introduces a feedback-driven regularization mechanism:

• Relative Overfitting Estimation: Clients locally estimate their overfitting level using the top Hessian eigenvalue ($\lambda_{max}$) and Hessian trace ($H_T$) of their local model. These metrics characterize the sharpness of the loss landscape; sharper landscapes indicate severe overfitting.
• Relative Ranking ($\rho_k$): The server aggregates these scalar metrics to compute a relative overfitting rank ($\rho_k$) for each client, representing their vulnerability relative to the federation. This rank is transmitted back to the client as targeted feedback.
• Adaptive Regularization: Upon receiving $\rho_k$, the client modifies their local loss function by adding a regularization term bounded by the Lipschitz constant (approximated by the Jacobian spectral norm). The modified loss is:
  $$L^*_k = L_k + \beta \cdot \rho_k \cdot ||J_k||$$
  Here, $\beta$ is a task-dependent parameter. Clients with higher relative overfitting ranks ($\rho_k$) are subjected to stronger regularization, forcing them to learn more generalizable representations and reducing their susceptibility to SIA.

2.3 Server-Side Intervention: Adaptive Aggregation

To address the symptoms of disparity, the server dynamically adjusts the aggregation weights of client updates:

• Risk Quantification: The server uses the client's relative overfitting rank ($\rho_k$) as a proxy for privacy risk.
• Adaptive Lightweight Aggregation (ALA): The server calculates aggregation weights ($\alpha_k$) inversely proportional to the risk rank:
  $$\alpha_k = \frac{1 - \rho_k}{\sum_{i=1}^K (1 - \rho_i)}$$
  This mechanism reduces the influence of highly vulnerable clients on the global model, preventing their memorized, outlier representations from disproportionately shaping the global parameters.
• Alternative Baseline: The paper also evaluates a PCA-based strategy for risk quantification but highlights ALA as the computationally efficient, scalable solution suitable for real-world deployment.

3. Key Contributions

The paper outlines four primary contributions:

1. Formal Definition: It introduces a formal definition of fairness-in-privacy (FinP) tailored for real-world human-centric machine learning systems, focusing on the equitable distribution of privacy risk.
2. Operationalization: It operationalizes the measurement of FinP within FL, specifically quantifying vulnerabilities to Source Inference Attacks (SIA).
3. Novel Framework: It proposes a two-pronged technical framework combining adaptive server-side aggregation and client-side Hessian-based regularization to optimize FinP.
4. Empirical Validation: It provides comprehensive evaluations on real-world (HAR) and standard (FEMNIST, CIFAR-10) datasets, demonstrating significant gains in privacy fairness with minimal loss in task utility.

4. Experimental Results

The framework was evaluated on three datasets: Human Activity Recognition (HAR), CIFAR-10, and FEMNIST, comparing FinP against standard FedAvg, state-of-the-art heterogeneity defenses (FedAlign), and Differential Privacy (DP-SGD).

4.1 Privacy Fairness Improvements

• HAR Dataset: FinP reduced the Coefficient of Variation (CoV) for SIA accuracy from 0.94 (Baseline) to 0.89, improving the Fairness Index (FI) by 5.56%. It reduced the Equal Opportunity Difference (EOD) by 5.45%, indicating a more uniform adversary success rate across clients.
• CIFAR-10 Dataset: FinP achieved a 43.1% improvement in the Fairness Index for prediction loss (FI(Loss)) compared to FedAlign. It reduced the EOD by 57.14%, mathematically guaranteeing a more uniform True Positive Rate for the adversary.
• Absolute Privacy: On CIFAR-10, FinP reduced the Mean SIA accuracy from ~30.86% (FedAvg) to 10.07%, effectively reducing the attack success rate to the level of random guessing (1/10).

4.2 Utility and Efficiency

• Model Utility: Contrary to the typical privacy-utility trade-off, FinP maintained or slightly improved global model utility. On CIFAR-10, FinP achieved a testing accuracy of 78.46%, marginally higher than FedAvg's 77.62%. On HAR, the degradation was minimal (approx. 1.75%).
• Efficiency: The framework required only a marginal increase in communication rounds to converge (e.g., 10 rounds vs. 9 for baseline in HAR).
• Comparison with DP: Differential Privacy (DP-SGD) was found to drastically degrade utility (e.g., a 34.7% drop in accuracy on HAR) while failing to improve empirical privacy fairness, often worsening the Fairness Index.

4.3 Ablation Studies

• Component Synergy: The full closed-loop system (Server + Client) yielded the highest fairness gains. Server-side aggregation alone addressed symptoms but was insufficient for structural fairness; client-side regularization alone reduced overfitting but lacked the global coordination to balance risk distribution.
• Computational Practicality: The Adaptive Lightweight Aggregation (ALA) strategy achieved identical fairness improvements to the computationally expensive PCA-based baseline while consuming only 17% of the computation time.

5. Significance and Claims

The paper claims that FinP establishes equitable privacy protections by reducing vulnerability disparities by up to 57.14% while preserving global model utility within a marginal ±1.75% of standard federated baselines.

The authors argue that FinP is significant because:

1. It shifts the focus from average privacy guarantees to equitable risk distribution, addressing the "zero trust" reality where some leakage is inevitable.
2. It demonstrates that strong fairness-in-privacy guarantees need not compromise model utility; in fact, by penalizing localized memorization, the framework can improve generalization and global accuracy.
3. It provides a scalable, practical solution (via ALA) that avoids the computational bottlenecks of traditional methods, making it viable for resource-constrained, real-world FL deployments.
4. It offers policymakers and system designers tangible metrics (such as EOD and FI) to enforce equitable protections and foster public trust in AI systems.

The paper concludes that without explicitly addressing the inequitable distribution of risk, FL risks reinforcing the very social inequalities it aims to bypass, and FinP offers a structural mechanism to prevent this digital inequality.