Federated Learning: Privacy's Double-Edged Sword

Federated learning (FL) offers an innovative approach to machine learning by enabling multiple data holders to collaborate without centralizing raw data. This has made it particularly appealing in privacy-sensitive sectors like healthcare. Yet, the promise of privacy comes with its own set of challenges.

The Privacy Paradox

FL's method of keeping data local while sharing only model updates, such as gradients or deltas, isn't as foolproof as once thought. These very updates can become a backdoor for attackers through gradient inversion attacks (GIAs). In an honest-but-curious server threat model, where servers are assumed to follow protocol but are curious about the data, these attacks can unravel private client data.

Architectural Defense

Our exploration into tabular FL reveals critical insights into how model architecture impacts data privacy. Using datasets like MIMIC-IV, we've put FL protocols to the test across various parameters, including client batch sizes and training stages. The findings are telling. Small client batches with updates reflecting fewer records are more prone to data leakage. Conversely, larger batches and solid aggregation diminish this risk, though they don't eliminate it.

Interestingly, FT-Transformers emerge as a harder nut to crack, consistently outperforming one-hot baselines in withstanding inversion attacks. Variability in reconstructability is also notable within the multilayer perceptron (MLP) family. It's clear that architecture isn't just a technical choice but a privacy strategy.

What Are We Really Recovering?

A significant takeaway is the distinction between aggregate reconstruction accuracy and the actual recovery of complete records. This becomes key when dealing with sparse data, where exact match rate (EMR) and baseline comparisons emerge as more reliable metrics than mere reconstruction accuracy.

If the AI can hold a wallet, who writes the risk model? The question isn’t just about tech jargon but about the practical implications of these findings. Architecture should be a focal point in privacy considerations, not an afterthought. In the end, slapping a model on a GPU rental isn't a convergence thesis.