Marcus Gozon
Pronouns: he, him, his
Research Mentor(s): Maria Han Veiga
Research Mentor School/College/Department: Mathematics / LSA
Program: UROP
Session: Session 5 (2:40pm – 3:30pm)
Authors: Marcus Gozon, Maria Veiga
Abstract
Federated learning has been proposed as a way to preserve the privacy of confidential patient data while allowing for machine learning’s numerous use cases by communicating the gradients of private data across the distributed system instead. Recently, however, it has been shown that a model’s training data can be reconstructed through a process known as Deep Leakage from Gradients (DLG), which presents a major privacy concern. In this project, we focus on the proposed algorithm, which has demonstrated how input images and texts could be reconstructed. However, the authors only considered a model with random weights, which does not reflect the actual models under attack, and so we consider how it holds up over the evolution of a model as it trains. Additionally, we consider tabular data, which does not have as much structure as the images and texts used in their experiments. Specifically, we are training a fully connected neural network on the IRIS dataset, a standard classification benchmark in machine learning, and the BRAZPD medical dataset, which contains patient data collected in a Brazilian study on Peritoneal Dialysis. At regular intervals, we apply the DLG algorithm to the gradients of a batch to simulate an attack in a federated learning environment, and the entire experiment is implemented through PyTorch’s machine learning framework. On the IRIS dataset, we were able to reconstruct the input data with high accuracy, but as the model approached convergence, it became harder to leak. We hope to reproduce this on the BRAZPD medical dataset, which is a larger dataset with real patient data that better reflects the federated learning environment. This result would imply that privacy concerns wouldn’t be as much of an issue during later stages of the training so that more focus should be placed on protecting privacy at the initial stages instead. Furthermore, it may imply that some initial training could be another strategy to mitigate the effectiveness of the DLG.
