GradCloak: Gradient Obfuscation for Privacy-Preserving Distributed Learning as a Service

Gradient leakage attacks pose a significant privacy threat in distributed learning-as-a-service APIs. Existing literature on gradient leakage defense relies on gradient perturbation for preventing privacy leakage. However, determining where and how much to perturb the gradient offers different capabilities for preventing gradient leakage. This paper presents GradCloak, a principled approach to guiding gradient perturbation with theoretical robustness bounds in federated learning as a service, aiming to find the minimum required noise for simultaneously achieving privacy protection, competitive accuracy, and preventing gradient leakage attacks. The paper is organized into three major components.First, we formulate the gradient leakage threats and their adverse effect. We categorize the attack into two broad types: leakage during local training and leakage before global aggregation.Second, we investigate different gradient perturbation approaches. We analyze and compare these gradient perturbation methods, which are performed at the federated server, with those performed at the participating client(s).Third, we introduce three robustness properties of robust perturbation against gradient leakage threats, formulated bythe anonymization boundfor training data robustness,the perturbation boundfor gradient robustness, andthe distribution robustness boundfor perturbed gradients. We conduct extensive evaluations on eight benchmark datasets to demonstrate that specific settings of gradient perturbation exist that best balance privacy, accuracy, and leakage prevention. Code is available athttps://github.com/git-disl/GradCloak.