DictPFL: Efficient and Private Federated Learning on Encrypted Gradients

AI summary

Overview

Research area: Privacy-preserving machine learning, specifically federated learning (FL) with homomorphic encryption (HE).

Technical level: Intermediate. Readers should know basic federated learning concepts (clients, gradient aggregation, FedAvg) and have a rough idea of what homomorphic encryption does. The math is present but not the central barrier to understanding.

Scope: This paper proposes DictPFL, a framework that makes HE-based federated learning practical by restructuring which parameters get trained, transmitted, and encrypted — achieving full-gradient privacy at a small fraction of the usual computational and communication cost.

What This Paper Is About

Federated learning lets multiple institutions train a shared model without exchanging raw data, but the gradients they do exchange can leak private information through gradient inversion attacks. Homomorphic encryption solves this in principle but is notoriously slow, and prior work cut costs by encrypting only "sensitive" gradients while sending the rest in plaintext — which reintroduces the leak. DictPFL's goal is to encrypt every transmitted gradient while still being fast enough to be usable, by making the set of transmitted gradients dramatically smaller.

Key Contributions

1. DePE (Decompose-for-Partial-Encrypt): A weight-decomposition scheme that splits a model's weight matrix into a frozen, globally shared dictionary D (never transmitted, never encrypted) and a small trainable lookup table T (encrypted and aggregated). Weights are reconstructed as W = W₀ + D·T, initialized via truncated SVD so the dictionary captures the most important weight directions.

2. PrME (Prune-for-Minimum-Encrypt): An encryption-aware pruning method that shrinks the lookup table further. It uses Temporal Inactivity Pruning (TIP), which prunes parameters whose gradients have been small across the previous τ rounds, and Holistic Reactivation Correction (HRC), which assigns reactivation probabilities so prematurely pruned parameters can rejoin aggregation (uploading accumulated gradients).

3. Mask-free consistent pruning: Unlike plaintext FL pruning, PrME guarantees clients prune identical indices without ever sharing a pruning mask with the server — avoiding both the SIMD slot-misalignment problem in ciphertext aggregation and a new plaintext side-channel.

4. End-to-end evaluation across vision (ViT on CIFAR-10, GTSRB, Diabetic Retinopathy) and language (BERT, TinyLlama on AG's News, MetaMathQA) tasks, plus an attack evaluation showing DictPFL resists gradient inversion where FedML-HE does not.

Main Findings

• Large communication and speed gains over full encryption: DictPFL reduces communication by 402–748× and accelerates training by 28–65× compared to a fully encrypted baseline (FedHE-Full), while maintaining comparable accuracy.

• Outperforms the strongest selective-encryption baseline: Against FedML-HE (which encrypts only the top 10% of gradients), DictPFL cuts overhead by 51–155× and speeds training by 4–19×, while achieving an average 98.3% communication reduction.

• Privacy is genuinely stronger, not just cheaper: The paper's gradient inversion experiment shows FedML-HE leaks reconstructions with up to 23% similarity to original images when 30% of gradients travel in plaintext; DictPFL, by encrypting all transmitted gradients, prevents this leakage entirely.

• Runtime is nearly plaintext-level: DictPFL's total training time is within 2× of non-private plaintext federated learning — a first for HE-based FL according to the authors.

• Small dictionaries suffice: Ablation on dictionary size r shows r=4 reaches 81.99% accuracy versus 82.74% for full encryption on Diabetic Retinopathy, at a fraction of the cost.

• Reactivation recovers pruning accuracy: With HRC enabled, 70% pruning achieves accuracy close to 20% pruning while retaining the communication efficiency of the more aggressive setting.

• Robust across model scale and task type: Gains hold for vision transformers, BERT-scale and TinyLlama-scale models, under different client counts and heterogeneity levels.

Methodology in Plain English

The core insight is that HE's cost scales with how many values you encrypt, so the authors attack the problem by reducing the number of trainable, transmitted parameters rather than by encrypting fewer of them.

Step 1 — Decomposition. Instead of training an entire weight matrix W, they take a pre-trained W₀ and run truncated SVD on it. The top-r singular vectors become a dictionary D that is identical for every client and stays on the client's disk, never leaving the device. The projection coefficients become a small lookup table T, initialized to zero and trained normally. Only T's gradients get encrypted and sent to the server. Since the dictionary is shared and static, the server never needs to see it.

Step 2 — Pruning. During training, most parameters in T stop changing meaningfully. Rather than encrypting those near-zero gradients, clients drop them — but only if they have been small for several consecutive rounds (the "patience" window τ), using the previous rounds' global gradients as the shared criterion. Because that history is identical across clients, all clients prune the same indices, so ciphertext slots stay aligned and the server can aggregate without needing any mask.

Step 3 — Reactivation. Pure pruning is irreversible, which hurts convergence. Each pruned parameter gets a probability pᵢ of being retried. If reactivation shows the parameter still has tiny gradients, pᵢ decays; if gradients turn out large, pᵢ grows. Reactivated parameters upload their accumulated gradients since being pruned, so nothing is truly thrown away. A shared random seed keeps clients' reactivation decisions synchronized without communication.

Setup. Encryption uses the CKKS scheme with bootstrapping via OpenFHE at 128-bit security, with 32,768 SIMD slots per ciphertext. The threat model is a semi-honest server, matching FedML-HE's assumptions: the server follows the protocol but tries to infer private information.

Why This Matters

Impact on research. This work reframes the HE-FL efficiency problem. Prior approaches either paid full encryption cost or accepted plaintext leakage in the name of speed; DictPFL shows a third path — shrinking the parameter space itself through decomposition and shared-index pruning. The mask-free, SIMD-compatible pruning design is a specific technical contribution that anyone building HE-based aggregation systems will need to reckon with.

Real-world applications:

• Cross-hospital medical AI: Training diagnostic models on distributed patient records where regulatory and ethical constraints forbid even indirect exposure, and where reconstruction attacks on gradients are a documented threat.
• Banking and financial fraud detection: Multiple institutions jointly training risk models without revealing transaction patterns or customer behavior.
• Enterprise text/LLM fine-tuning: Companies fine-tuning large language models on proprietary documents across departments or subsidiaries with encrypted-only gradient exchange.
• Regulated cross-border collaborations: Any setting where data residency laws prevent centralizing data and where a single-server infrastructure (unlike MPC) is required.

Industry relevance. Existing HE-FL platforms (IBM FL, Nvidia FLARE) have had HE support but have not solved its overhead. A framework that runs within 2× of plaintext federated learning and requires no trusted-server assumption, no accuracy-privacy trade-off (unlike differential privacy), and no multi-party protocol removes the main practical objection to deploying encrypted federated learning in production.

Future Directions

• Cross-device federated learning: The current evaluation targets cross-silo settings with relatively capable clients. Extending to edge devices with limited memory and compute for encryption is explicitly flagged as future work.

• Non-transformer architectures: All evaluated models are transformer-based. Whether the dictionary-plus-lookup decomposition works as well on CNNs, RNNs, or state-space models remains untested.

• Dynamic dictionaries: DictPFL uses a fixed, shared dictionary. A dynamic dictionary that adapts per client could improve personalization in highly heterogeneous environments where a single global basis is a poor fit.

• Communication-efficiency versus convergence theory: The reactivation scheme is heuristic. A principled analysis of how much convergence loss PrME can tolerate, and how to set s, τ, and β optimally, is not provided.

Target Audience

Researchers and engineers working on privacy-preserving machine learning, especially those implementing or evaluating homomorphic-encryption-based federated learning. It is also relevant to practitioners in regulated industries (healthcare, finance) evaluating whether encrypted federated learning is now operationally viable, and to anyone studying gradient inversion attacks and defenses. Readers looking for deep cryptographic theory will find it lighter on that front — the contribution is systems and algorithm design rather than new hardness results.

Authors’ abstract

Federated Learning (FL) enables collaborative model training across institutions without sharing raw data. However, gradient sharing still risks privacy leakage, such as gradient inversion attacks. Homomorphic Encryption (HE) can secure aggregation but often incurs prohibitive computational and communication overhead. Existing HE-based FL methods sit at two extremes: encrypting all gradients for full privacy at high cost, or partially encrypting gradients to save resources while exposing vulnerabilities. We present DictPFL, a practical framework that achieves full gradient protection with minimal overhead. DictPFL encrypts every transmitted gradient while keeping non-transmitted parameters local, preserving privacy without heavy computation. It introduces two key modules: Decompose-for-Partial-Encrypt (DePE), which decomposes model weights into a static dictionary and an updatable lookup table, only the latter is encrypted and aggregated, while the static dictionary remains local and requires neither sharing nor encryption; and Prune-for-Minimum-Encrypt (PrME), which applies encryption-aware pruning to minimize encrypted parameters via consistent, history-guided masks. Experiments show that DictPFL reduces communication cost by 402-748$\times$ and accelerates training by 28-65$\times$ compared to fully encrypted FL, while outperforming state-of-the-art selective encryption methods by 51-155$\times$ in overhead and 4-19$\times$ in speed. Remarkably, DictPFL's runtime is within 2$\times$ of plaintext FL, demonstrating for the first time, that HE-based private federated learning is practical for real-world deployment. The code is publicly available at https://github.com/UCF-ML-Research/DictPFL.