Abstract
Decentralized federated learning faces privacy risks because model updates can leak data through inference attacks and membership inference, a concern that grows over many client exchanges. Differential privacy offers principled protection by injecting calibrated noise so confidential information remains secure on resource-limited IoT devices. Yet without transparency, black-box training cannot track noise already injected by previous clients and rounds, which forces worst-case additions and harms accuracy. We propose PrivateDFL, an explainable framework that joins hyperdimensional computing with differential privacy and keeps an auditable account of cumulative noise so each client adds only the difference between the required noise and what has already been accumulated. We evaluate on MNIST, ISOLET, and UCI-HAR to span image, signal, and tabular modalities, and we benchmark against transformer-based and deep learning-based baselines trained centrally with Differentially Private Stochastic Gradient Descent (DP-SGD) and Renyi Differential Privacy (RDP). PrivateDFL delivers higher accuracy, lower latency, and lower energy across IID and non-IID partitions while preserving formal (epsilon, delta) guarantees and operating without a central server. For example, under non-IID partitions, PrivateDFL achieves 24.42% higher accuracy than the Vision Transformer on MNIST while using about 10x less training time, 76x lower inference latency, and 11x less energy, and on ISOLET it exceeds Transformer accuracy by more than 80% with roughly 10x less training time, 40x lower inference latency, and 36x less training energy. Future work will extend the explainable accounting to adversarial clients and adaptive topologies with heterogeneous privacy budgets.
Abstract (translated)
去中心化的联邦学习由于模型更新可能通过推理攻击和成员推断等方式泄露数据，因此面临着隐私风险。随着多个客户端之间的交互增加，这种担忧也在加剧。差分隐私（Differential Privacy）提供了一种原则性的保护方法，通过注入校准噪声来确保在资源受限的物联网设备上保密信息的安全性。然而，在缺乏透明度的情况下，黑盒训练无法追踪之前客户端和轮次中已经注入的噪声，这迫使每次必须增加最坏情况下的噪音量，并损害了准确性。 我们提出了一种名为PrivateDFL的可解释框架，该框架结合了超维度计算（Hyperdimensional Computing）与差分隐私技术，并维护了一个可以审计的累计噪声记录，使得每个客户端只需添加所需噪声与其之前累积噪声之间的差异部分。我们在MNIST、ISOLET和UCI-HAR数据集上进行了测试，涵盖图像、信号和表格模态，并将PrivateDFL与其他基于转换器（Transformer）和深度学习且使用中心化训练的Differentially Private Stochastic Gradient Descent (DP-SGD) 和 Renyi Differential Privacy (RDP) 方法进行基准比较。结果表明，在保持正式的(epsilon, delta)保证的同时，PrivateDFL在IID和非IID数据分区上都提供了更高的准确率、更低的延迟和能耗，并且无需中央服务器支持。 具体而言，在处理非IID数据分区时，与视觉转换器相比，PrivateDFL在MNIST数据集上的准确性提高了24.42%，训练时间减少了约10倍，推理延迟降低了76倍，训练能量消耗减少了11倍；而在ISOLET数据集上，PrivateDFL的准确率超出转换器模型80%以上，并且训练时间减少大约10倍、推理延迟降低40倍以及训练能耗减少36倍。 未来的工作计划将可解释性账目扩展到对抗客户端和自适应拓扑结构中具有异构隐私预算的情况。
URL
https://arxiv.org/abs/2509.10691
