💻 computer science

Federated Learning Framework with Differential Privacy over Homomorphic Vector Encryption for Data-Sensitive Applications

The paper proposes a lightweight, secure Federated Learning framework that integrates Differential Privacy with Homomorphic Vector Encryption to protect data-sensitive applications like IoMT from reverse-engineering attacks while quantifying the associated predictive and cryptographic overheads.

Original authors: Manu Narula, Jasraj Meena, Dinesh Vishwakarma

Published 2026-08-26

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Manu Narula, Jasraj Meena, Dinesh Vishwakarma

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital world, artificial intelligence has become a quiet engine driving decisions in healthcare, finance, and daily life. To learn effectively, these systems traditionally require vast amounts of data, often pulling personal information from millions of users into a central warehouse. This approach creates a significant risk: if that central warehouse is breached, private details about individuals are exposed. To solve this, researchers developed a method called federated learning. Instead of moving data to a central computer, the computer model travels to the data. Each device, like a smartphone or a medical sensor, trains the model locally using its own private information and sends only the learned improvements back to the central server. The raw data never leaves the device. However, even these improvements can sometimes be reverse-engineered by a curious observer to reveal the original data, leaving a gap in security for the most sensitive applications.

A team of researchers has proposed a new framework designed to close this gap, specifically for environments where data is highly confidential, such as medical records or financial details. Their solution, named Fed-DHVE, combines two distinct layers of protection to ensure that neither the central server nor an outside eavesdropper can see what any single user contributed. The first layer adds a calculated amount of random noise to the learning updates before they are sent. This technique, known as differential privacy, ensures that the presence or absence of any single person's data does not noticeably change the final result, effectively blurring the link between the update and the individual. The second layer encrypts these noisy updates using a special mathematical system that allows the server to combine them without ever unlocking or seeing the individual pieces. Only the final, combined result is decrypted to improve the global model.

The researchers tested this system by simulating a network of one thousand devices working together to recognize images, a common task for artificial intelligence. They compared their new framework against standard methods and other existing security techniques. The results showed that the system successfully trained accurate models while keeping individual contributions hidden. On four different image datasets, the framework achieved high levels of accuracy, ranging from roughly 94 percent to nearly 98 percent. While this was slightly lower than a standard, unsecured system, the drop was expected and represents a deliberate trade-off to gain stronger privacy. The system also measured the time required to perform the complex encryption and decryption steps, finding that it took just over two seconds to encrypt the updates and less than one second to decrypt the final combined result.

The study highlights that while the system works well in this simulated environment, it is not yet a complete solution for every possible threat. The researchers explicitly noted that their current setup protects against a server that follows the rules but tries to learn from the data, as well as against outside listeners, but it does not yet address attacks where a user might try to poison the model or trick the system. Furthermore, the study did not include specific tests to see if an attacker could still reconstruct the original images from the noisy, encrypted data, nor did it calculate a precise mathematical privacy score for the entire process. These are identified as necessary next steps for validation. The work demonstrates that it is feasible to stack these two security methods together to protect data in resource-constrained settings, offering a stable path forward for sensitive applications like the Internet of Medical Things, where the cost of a data leak is far too high to ignore.

Technical Summary: Federated Learning Framework with Differential Privacy over Homomorphic Vector Encryption for Data-Sensitive Applications

Problem Statement
Federated Learning (FL) has emerged as a privacy-preserving paradigm for training machine learning models across decentralized devices, particularly in data-sensitive domains like healthcare (IoMT) and finance. In standard FL, clients share model updates (gradients) rather than raw data. However, recent research indicates that native FL implementations are vulnerable to reverse-engineering attacks, where adversaries can reconstruct sensitive datasets from shared gradients. While existing solutions often rely on quantization to reduce communication overhead and enhance security, these methods frequently incur significant accuracy trade-offs that cannot be fully recovered by auxiliary algorithms. Furthermore, standard FL lacks robust mechanisms to protect against "honest-but-curious" servers or external eavesdroppers who might intercept transmission data.

Methodology: The Fed-DHVE Framework
The authors propose Fed-DHVE, a hybrid framework designed for resource-constrained, data-sensitive applications. This framework integrates three core components to address the limitations of current secure FL approaches:

Differential Privacy (DP): To mitigate statistical leakage from individual updates, the framework employs Local Differential Privacy. During the local training phase, clients clip their gradients to a maximum norm ( $C$ ) and add calibrated Gaussian noise ( $\mathcal{N}(0, \sigma^2 C^2 I)$ ). This ensures that the inclusion or exclusion of any single data record has a bounded impact on the output distribution.
Homomorphic Vector Encryption (HE): To protect the confidentiality of updates during transmission and aggregation, the framework utilizes a Conjugate Search Problem (CSP)-based homomorphic encryption scheme. Unlike Fully Homomorphic Encryption (FHE), which is computationally prohibitive, this approach uses CSP-based constructions to allow arithmetic operations (specifically aggregation) on encrypted vectors. Clients encrypt their noisy gradients before transmission; the server aggregates these ciphertexts without decrypting individual updates, decrypting only the final aggregate to update the global model.
Workload-Aware Client Selection: To optimize performance in heterogeneous environments, the framework incorporates a client selection mechanism based on a scoring function ( $S_i = \alpha c_i + \beta p_i - \gamma q_i$ ). This score balances normalized computational capacity ( $c_i$ ), historical participation/performance ( $p_i$ ), and estimated workload/completion cost ( $q_i$ ), ensuring that slow or overloaded devices do not dominate communication rounds.

The proposed workflow (Algorithm 3) proceeds as follows: The server selects a subset of clients and distributes the global model. Selected clients compute local gradients, clip them, add DP noise, and encrypt the result using CSP-based HE. The server performs homomorphic aggregation on the encrypted updates, decrypts the aggregate, and updates the global model.

Key Contributions
The paper outlines three primary contributions:

Hybrid Security Architecture: The introduction of a framework that combines Differential Privacy with Homomorphic Vector Encryption to simultaneously reduce statistical leakage and protect the confidentiality of client update vectors.
Encryption Integration: The integration of HE during parameter transmission to ensure confidentiality against eavesdroppers and honest-but-curious servers, moving beyond simple quantization-based security.
Empirical Evaluation: An evaluation of the framework across multiple image classification datasets (MNIST, Fashion-MNIST, EMNIST, CIFAR-10) to quantify the trade-offs between predictive utility and cryptographic overhead.

Experimental Results
The framework was evaluated on a simulated federation of 1,000 devices using an Ubuntu 20.04 system with dual NVIDIA Titan RTX GPUs. The results were compared against Standard FL, quantization-based methods (Fed-MSQE), and other secure aggregation baselines (VerifyNet, Turbo-Aggregate, Fed-DLC).

Predictive Performance: Fed-DHVE achieved accuracies of 0.9783 (MNIST), 0.9397 (Fashion-MNIST), 0.9681 (EMNIST), and 0.9492 (CIFAR-10). The authors note that these results are lower than Standard FL (e.g., 0.9843 on MNIST), which is attributed to the expected utility cost of adding Gaussian noise for differential privacy.
Cryptographic Overhead: The framework recorded an average encryption time of 2.04 seconds and a decryption time of 0.72 seconds per round.
Comparison: While Fed-DHVE showed a reduction in accuracy compared to Standard FL, it offered stronger privacy guarantees than quantization-only approaches. The authors emphasize that the results demonstrate the feasibility of combining DP with encrypted aggregation but do not claim to have fully restored the accuracy lost to quantization or noise.

Significance and Claims
The paper positions Fed-DHVE as a viable alternative for data-sensitive applications where standard FL is insufficient due to privacy risks. The authors explicitly state that their work aims to replace quantization as the base security measure to provide a stable and private environment for Data-Sensitive Application (DSA) implementations. This approach is proposed in response to identified critical challenges in the literature, specifically the "Accuracy Trade-off" and "Incomplete Recovery" issues associated with existing quantization-based mechanisms, where no auxiliary algorithm has been able to fully restore original accuracy.

However, the authors maintain a modest stance regarding their claims:

Scalability: The study is limited to a simulated population of 1,000 devices; claims regarding scalability to substantially larger networks are deferred to future work.
Security Validation: The paper acknowledges that accuracy and timing metrics alone do not establish resistance to specific privacy attacks. The authors identify the need for future work to include explicit $(\epsilon, \delta)$ privacy budget calculations, gradient inversion attacks, and membership inference evaluations to fully validate the security claims.
Cryptographic Proof: The manuscript utilizes CSP-based abstractions (ECSP/DCSP) and reports timing metrics but does not provide a new cryptographic security proof, deferring detailed cryptographic validation to future iterations.

In conclusion, the paper demonstrates that combining Differential Privacy and Homomorphic Vector Encryption is a feasible strategy for securing Federated Learning in sensitive environments, provided that the associated computational overhead and accuracy trade-offs are accepted.

More like this