💻 computer science

Towards Explainable Privacy Preservation in Federated Learning via Shapley Value-Guided Noise Injection

This paper introduces FedSVA, an explainable differential privacy mechanism for federated learning that leverages Shapley Values to dynamically calibrate noise injection based on attribute contributions, thereby achieving state-of-the-art privacy-utility trade-offs while providing rigorous convergence and security guarantees.

Original authors: Yunbo Li, Jiaping Gui, Yue Wu

Published 2026-04-02

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yunbo Li, Jiaping Gui, Yue Wu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you and a group of friends want to build a really smart AI that can recognize cats and dogs. But there's a catch: no one wants to show their personal photos to anyone else. They are worried that if they share their pictures, someone might steal them or figure out who they are.

This is where Federated Learning comes in. Instead of sending photos to a central computer, everyone keeps their photos on their own phones. They just send the "lessons" they learned (the math updates) to a central teacher, who combines them to make the AI smarter.

But here's the problem: Even just sending the "lessons" can be risky. A sneaky hacker (or a curious friend) could look at those lessons and reverse-engineer them to guess what your photos looked like.

To stop this, we usually add noise (static) to the lessons, like putting a foggy filter over a photo. This hides the details. But there's a big flaw in how we usually do this: We guess how much fog to add.

If we add too much fog, the AI gets confused and can't learn anything useful.
If we add too little fog, the hacker can still see your photos.

Enter FedSVA: The "Fairness Detective"

The paper introduces a new method called FedSVA. Think of it as a smart, fair system that decides exactly how much fog to add, based on how much your specific data actually matters to the final result.

Here is how it works, using a simple analogy:

1. The Shapley Value: The "Team Score"

Imagine you are on a sports team. Some players are superstars who score most of the goals; others are just there to pass the ball.

Old Way: We put a giant foggy filter over everyone's stats, just in case. This makes the whole team look blurry and hard to understand.
FedSVA Way: It uses a mathematical tool called Shapley Values (named after a game theorist) to act like a referee. The referee looks at every player and asks: "How much did this specific player actually contribute to the team's win?"

In the AI world, the "players" are different parts of your data (like "private photos" vs. "public photos").

If your private data is crucial to the AI's learning (like a superstar player), the system says, "Okay, this is high risk. We need heavy fog to protect it."
If your private data is not very important to the AI (like a bench warmer), the system says, "This is low risk. We only need light fog."

2. The Result: Clearer Vision, Stronger Security

Because FedSVA only adds heavy fog where it's absolutely necessary, the AI stays much sharper and learns faster than before.

The Trade-off: Usually, you have to choose between "Super Secure but Dumb AI" or "Smart AI but Insecure." FedSVA gives you the best of both worlds: High Security + High Intelligence.

3. The Proof

The researchers tested this on famous image datasets (like recognizing cars and handwritten letters).

The Test: They let hackers try to rebuild the original photos from the "lessons" sent over the network.
The Result: With FedSVA, the hackers failed miserably. The reconstructed images were just blurry, unrecognizable blobs. Meanwhile, the AI still learned to recognize objects with very high accuracy, beating all other current methods.

Summary in a Nutshell

Think of FedSVA as a smart security guard who doesn't just lock every door in the building with a massive steel vault. Instead, the guard checks who is in each room:

If someone is holding a diamond (high-risk private data), they get a super-strong vault.
If someone is holding a rubber ball (low-risk data), they get a simple lock.

This way, the building is secure, but the people inside can still move around freely and do their work efficiently. This makes Federated Learning safer, smarter, and easier to explain to everyone.

1. Problem Statement

Federated Learning (FL) allows collaborative model training without sharing raw data, yet it remains vulnerable to sophisticated privacy attacks such as model inversion and membership inference. While Differential Privacy (DP) is the standard mathematical framework for mitigating these risks by injecting noise into model updates, existing FL-DP methods suffer from two critical limitations:

Lack of Explainability: Current methods determine noise scales using heuristic factors (e.g., training progress, time-varying schedules) rather than the actual privacy risk posed by specific data attributes. This creates an "opaque" relationship between the injected noise and the data being protected.
Suboptimal Trade-offs: Heuristic approaches often lead to either excessive noise (degrading model utility) or insufficient noise (failing to protect sensitive data), resulting in a poor privacy-utility balance.

The core problem addressed is the need for a principled, explainable noise scheduling mechanism that dynamically adjusts noise injection based on the quantifiable contribution of private attributes to the model's training.

2. Methodology: FedSVA

The authors propose FedSVA, a novel FL mechanism that integrates Shapley Values (from cooperative game theory) with Differential Privacy. The system operates on the client side with two primary modules:

A. Privacy Estimation (PE) Module

This module quantifies the "privacy contribution" of specific data attributes using Shapley Values.

Attribute Partitioning: Clients partition their local dataset $D_i$ into subsets based on attributes (e.g., private attributes $D^p_i$ vs. non-private attributes $D^a_i$ ).
Shapley Calculation: For a given training round, the client enumerates subsets of attributes to train auxiliary models. It calculates the Shapley Value ( $\psi$ ) for each attribute, representing its marginal contribution to the model's utility (local validation accuracy).
Contribution Rate ( $R^p_i$ ): The system computes the ratio of the Shapley value of private attributes to the total Shapley value of all attributes. A higher $R^p_i$ indicates that private data is driving the model's performance, necessitating stronger privacy protection.

B. Noise Injection (NI) Module

This module translates the contribution rate into a dynamic noise scale.

Risk Tolerance: The contribution rate is mapped to a risk tolerance threshold $T^p_i$ .
Dynamic Noise Scale: The standard deviation ( $\sigma_i$ $σ_{i}$ ) for the Gaussian noise is calibrated based on $R^p_i$ $R_{i}^{p}$ .
- If $R^p_i$ is high (high privacy risk), $\sigma_i$ increases to provide stricter DP guarantees.
- If $R^p_i$ is low, $\sigma_i$ decreases to preserve model utility.
Formal Guarantees: The mechanism ensures $(\epsilon, \delta)$ -DP guarantees, where $\delta'$ is dynamically adjusted based on the contribution rate.

C. Theoretical Analysis

Privacy: FedSVA provides rigorous $(\epsilon, \delta')$ -DP guarantees per round and $(T\epsilon, T\delta')$ over $T$ rounds.
Convergence: The paper proves that FedSVA converges under standard assumptions (L-smoothness, bounded gradients). The convergence bound includes a term dependent on the noise variance, demonstrating that the algorithm converges despite the injected noise, with the error scaling quadratically with the number of selected clients.

3. Key Contributions

First Explainable DP Mechanism: FedSVA is the first FL privacy mechanism to integrate Shapley Values with DP, explicitly linking noise levels to the quantified contribution of private attributes.
Dynamic & Precise Calibration: Unlike static or heuristic methods, FedSVA dynamically adjusts noise injection round-by-round based on the actual "privacy value" of the data, minimizing unnecessary noise.
Rigorous Theory: The work provides formal proofs for both privacy guarantees and the convergence of the federated optimization process under the proposed noise schedule.
Superior Performance: Extensive experiments demonstrate that FedSVA achieves state-of-the-art (SOTA) privacy-utility trade-offs and robust defense against reconstruction attacks.

4. Experimental Results

The authors evaluated FedSVA on CIFAR-10 (using ResNet-18) and FEMNIST (using CNN) against four SOTA baselines: NbAFL, Time-Varying DP (TV DP), Sensitivity Re-estimation DP (Sens DP), and Dynamic Privacy Allocation (DPA DP).

Privacy-Utility Trade-off:
- On CIFAR-10 with a strict privacy budget ( $\epsilon = 0.2$ ), FedSVA achieved a Final-5 accuracy of 75.98%, significantly outperforming DPA DP (65.21%) and NbAFL (48.67%).
- FedSVA consistently maintained higher accuracy across all tested $\epsilon$ values (0.2 to 0.5) compared to all baselines.
Noise Efficiency:
- FedSVA injected substantially less noise than static methods (NbAFL) and dynamic baselines.
- It consumed a smaller cumulative privacy budget over the training process, indicating more efficient use of the privacy allowance.
Defense Against Attacks:
- Against ACGAN-based reconstruction attacks, FedSVA achieved a 149% increase in Fréchet Inception Distance (FID) compared to the non-private FedAvg baseline, effectively obfuscating sensitive data while maintaining high utility.
Efficiency & Granularity:
- Experiments on attribute partition granularity ( $N$ ) showed that a binary partition ( $N=2$ : private vs. non-private) offers the best balance, achieving near-optimal accuracy with manageable computational overhead. Finer partitions ( $N>2$ ) yielded negligible accuracy gains (<0.22%) but increased runtime by >4x due to exponential Shapley computation costs.

5. Significance

This paper addresses a critical gap in Federated Learning by moving privacy preservation from a "black box" heuristic approach to a transparent, data-driven strategy.

Interpretability: It allows practitioners to understand why a specific amount of noise is injected (based on the data's contribution), fostering trust in FL systems.
Efficiency: By avoiding "one-size-fits-all" noise injection, FedSVA maximizes model utility without compromising security, making DP more viable for real-world deployment.
Scalability: The proposed method adds zero communication overhead, with costs limited to local computation, making it suitable for resource-constrained edge devices.

Future work suggested by the authors includes developing approximation methods for Shapley Value computation to further reduce complexity and enable fine-grained privacy analysis in large-scale deployments.