Selective encryption hardens federated learning against MitM

Problem

Federated learning (FL) keeps raw data on devices but still exposes gradient updates that can be exploited. Two concrete threats in automotive driver-monitoring FL are Man‑in‑the‑Middle (MitM) interception of gradients in transit and model poisoning by compromised clients. Differentially private training (DP‑SGD) limits information in updates but offers no communication confidentiality, while full homomorphic encryption (HE) secures communication at high computational cost. The paper studies how to simultaneously prevent gradient leakage in transit and preserve robustness to poisoning with practical overheads for edge scenarios.

Approach

The authors propose GASHE (Gradient‑Aware Selective Homomorphic Encryption), a selective CKKS encryption scheme that encrypts only gradient components whose magnitudes exceed a threshold derived from DP‑SGD calibration. They build SecureDrive‑FL by coupling DP‑SGD (per‑sample clipping and Gaussian noise; per‑round ε0=4, C=1.2, σ≈1.2112, 120 rounds) with GASHE so the DP sensitivity bound directly defines a binary mask of high‑sensitivity coordinates. Clients send two streams: encrypted high‑magnitude components under the server public key and plaintext, low‑magnitude components plus the bitmask. The server homomorphically aggregates encrypted streams and sums plaintext components separately to recover full updates. Evaluation uses a ten‑class distracted‑driver image task with non‑IID, user‑partitioned data, MobileNetV2‑Tiny models, and adversaries performing passive/active MitM interception and multi‑round model poisoning. Baselines include DP‑SGD alone, full‑CKKS, GASHE‑only, robust aggregators and BatchCrypt.

Key Findings

• SecureDrive‑FL prevents MitM interception from collapsing training: final accuracy under MitM is 78.2% for SecureDrive‑FL versus 10.4% for DP‑SGD alone, showing that selective encryption of DP‑informed high‑sensitivity gradients closes the interception attack surface.
• SecureDrive‑FL retains poisoning robustness comparable to DP‑SGD alone: final accuracy 73.6% versus 74.0% and identical Attack Success Rate (ASR) of 3.9%, indicating GASHE adds confidentiality without degrading DP‑based resistance to crafted updates.
• In clean training SecureDrive‑FL reaches 82.2% versus 80.0% for DP‑SGD alone, and GASHE alone matches unencrypted utility but collapses under poisoning because it lacks DP’s bounded update norm.
• Runtime overhead of combining GASHE with DP‑SGD is modest: SecureDrive‑FL incurs approximately 8–10% extra runtime relative to DP‑SGD alone; peak memory increases but remains in the same order of magnitude for the tested setup.
• Practical implementation notes: deriving the HE mask from DP parameters provides a principled closed‑loop design, but bookkeeping for mask computation and stream splitting reduces some expected runtime/memory savings compared with full‑CKKS in the current implementation.

Limitations

The evaluation is restricted to a single image classification use case with MobileNetV2‑Tiny over 120 rounds on a single host emulating clients. The threat model assumes an honest‑but‑curious aggregator and does not target Byzantine‑tolerant or Sybil attacks; integrating Byzantine‑robust aggregation is noted as future work. Composed DP over many rounds yields a large cumulative εtotal (≈48.94 for the reported configuration). The implementation overhead from mask management offsets some encryption savings, so per‑round gains depend on engineering optimisation.

Implications

For an attacker, the results show that passive or active interception of plaintext gradients can destroy training unless communication confidentiality is applied; selective encryption guided by DP calibration effectively blocks such attacks. Conversely, model poisoning remains an effective threat when DP bounds are not enforced, so attackers aiming to implant backdoors can exploit systems that employ encryption alone. The public transmission of the binary mask and a plaintext low‑magnitude stream mean an interceptor still observes DP‑dominated signals and mask positions, but those components are designed to be dominated by DP noise and thus less useful for inversion. Overall, SecureDrive‑FL demonstrates that an attacker must now control clients to poison models or bypass DP guarantees rather than merely intercept transit traffic.