Leakage-Guided Selective Threshold Homomorphic Aggregation for Privacy-Preserving Federated Learning

Abstract

Federated learning (FL) preserves data locality but leaks client properties and samples through shared updates. Homomorphic encryption (HE) hides individual updates from an honest-but-curious server, yet single-key CKKS concentrates trust and full-model encryption inflates bandwidth by an order of magnitude. We propose a threshold-CKKS framework with a leakage-guided selective layer encryption rule that fixes a named attacker, declares a visible-surface leakage budget <inline-formula> <tex-math notation="LaTeX">$\epsilon $ </tex-math></inline-formula>, and encrypts the smallest layer set respecting it. The rule recovers FedML-HE, MaskCrypt, and Mazzone et al. as structural instances of one <inline-formula> <tex-math notation="LaTeX">$(\textsf {Probe}, \mathcal {C}, \epsilon, {\mathcal {A}})$ </tex-math></inline-formula> choice; a Hoeffding sample-complexity bound calibrates the probe. In PFLlib (Lattigo backend) we run 142 FedAvg runs, plus 31 supplementary and 34 attack probes, on CIFAR-10 and CIFAR-100 under IID and Dirichlet partitions. Encrypted aggregation preserves accuracy within seed-level variation; full threshold HE costs <inline-formula> <tex-math notation="LaTeX">$2.6\times $ </tex-math></inline-formula> round time and <inline-formula> <tex-math notation="LaTeX">$40.9\times $ </tex-math></inline-formula> upload. The main result is per-attacker asymmetry. Under the property-inference audit (<inline-formula> <tex-math notation="LaTeX">$K{=}740$ </tex-math></inline-formula>, 37 seeds), no partial scheme meets <inline-formula> <tex-math notation="LaTeX">$\epsilon {=}0.15$ </tex-math></inline-formula> (classifier-only, fc+head, and head+conv2 leave advantage 0.21–0.23), so only full encryption is admissible; the <inline-formula> <tex-math notation="LaTeX">$K{=}160$ </tex-math></inline-formula> probe judged classifier-only admissible (0.144), overturned by the larger audit, consistent with the Hoeffding bound (<inline-formula> <tex-math notation="LaTeX">$\delta _{K=160}\approx 0.215$ </tex-math></inline-formula>, <inline-formula> <tex-math notation="LaTeX">$K{\geq }738$ </tex-math></inline-formula>). Against reconstruction attackers the verdict is more permissive but still excludes the cheapest scheme: fc+head encryption meets the declared 0 dB reconstruction budget under the evaluated gradient-inversion attack (<inline-formula> <tex-math notation="LaTeX">$K{=}20$ </tex-math></inline-formula>, 12000 iterations; PSNR −14.7 dB), and a second deep-leakage attacker provides supporting evidence (label recovery drops from 100% to 25%; no DLG-specific budget is declared, so no formal DLG verdict is issued), whereas classifier-only encryption, despite its <inline-formula> <tex-math notation="LaTeX">$17.3\times $ </tex-math></inline-formula> upload saving, leaves reconstruction quality essentially at the plaintext level (PSNR 22.1 dB) and is therefore inadmissible under the declared IG reconstruction budget. ResNet-10 validation preserves this structure. All findings are scoped to cross-silo FL (20 stable clients, honest-but-curious server, CIFAR-scale models); selective HE is an attacker-specific exposure-reduction tool rather than a substitute for full-model encryption, and its admissible region must be declared together with the threat model.