CoChat
Sign Up
Cited by 162Privacy-Preserving Technologies in DataCryptography and Data SecurityCloud Data Security Solutions

POSEIDON: Privacy-Preserving Federated Neural Network Learning

Open access
Sav, Sinem, Pyrgelis, Apostolos, Troncoso-Pastoriza, Juan Ramón, Froelicher, David, Bossuat, Jean-Philippe, Sousa, Joao Sa, Hubaux, Jean-Pierre·2021·Proceedings 2021 Network and Distributed System Security Symposium
DOI 10.14722/ndss.2021.24119
Open this paper in CoChat — free account

Abstract

Furthermore, the trusted party becomes a single point of failure, thus both data and model privacy could be compromised by data breaches, hacking, leaks, etc.Hence, solutions originating from the cryptographic community replace and emulate the trusted party with a group of computing servers.In particular, to enable privacy-preserving training of NNs, several studies employ multiparty computation (MPC) techniques and operate on the two [83], [28], three [82], [110], [111], or four [26], [27] server models.Such approaches, however, limit the number of parties among which the trust is split, often assume an honest majority among the computing servers, and require parties to communicate (i.e., secret share) their data outside their premises.This might not be acceptable due to the privacy and confidentiality requirements and the strict data protection regulations.Furthermore, the computing servers do not operate on their own data or benefit from the model training; hence, their only incentive is the reputation harm if they are caught, which increases the possibility of malicious behavior.A recently proposed alternative for privacy-preserving training of NNs -without data outsourcing -is federated learning.Instead of bringing the data to the model, the model is brought (via a coordinating server) to the clients, who perform model updates on their local data.The updated models from the parties are averaged to obtain the global NN model [75], [63].Although federated learning retains the sensitive input data locally and eliminates the need for data outsourcing, the model, that might also be sensitive, e.g., due to proprietary reasons, becomes available to the coordinating server, thus placing the latter in a position of power with respect to the remaining parties.Recent research demonstrates that sharing intermediate model updates among the parties or with the server might lead to various privacy attacks, such as extracting parties' inputs [53], [113], [120] or membership inference [78], [86].Consequently, several works employ differential privacy to enable privacy-preserving exchanges of intermediate values and to obtain models that are free from adversarial inferences in federated learning settings [67], [101], [76]. Although differentially private techniques partially limit attacks to federated learning, they decrease the utility of the data and the resulting ML model.Furthermore, training robust and accurate models requires high privacy budgets, and as such, the level of privacy achieved in practice remains unclear [55].Therefore, a distributed privacy-preserving deep learning approach requires strong cryptographic protection of the intermediate model updates during the training, as well as of the final model weights.Recent cryptographic approaches for private distributed learning, e.g., [119], [42], not only have limited ML functionalities, i.e., regularized or generalized linear models, but also employ traditional encryption schemes that make them vulnerable to post-quantum attacks.This should be cautiously considered, as recent advances in quantum computing [47], [87], [105], [116], increase the need for deploying quantum-resilient cryptographic schemes that eliminate Abstract-In this paper, we address the problem of privacypreserving training and evaluation of neural networks in an N-party, federated learning setting.We propose a novel system, POSEIDON, the first of its kind in the regime of privacy-preserving neural network training.It employs multiparty lattice-based cryptography to preserve the confidentiality of the training data, the model, and the evaluation data, under a passive-adversary model and collusions between up to N -1 parties.To efficiently execute the secure backpropagation algorithm for training neural networks, we provide a generic packing approach that enables Single Instruction, Multiple Data (SIMD) operations on encrypted data.We also introduce arbitrary linear transformations within the cryptographic bootstrapping operation, optimizing the costly cryptographic computations over the parties, and we define a constrained optimization problem for choosing the cryptographic parameters.Our experimental results show that POSEIDON achieves accuracy similar to centralized or decentralized non-private approaches and that its computation and communication overhead scales linearly with the number of parties.POSEIDON trains a 3-layer neural network on the MNIST dataset with 784 features and 60K samples distributed among 10 parties in less than 2 hours.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.14722/ndss.2021.24119

Cites

119 of 119 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Emerging applications include IoT-enabled monitoring platforms, distributed industrial control systems, and privacy-preserving RCA in smart manufacturing and healthcare microservices.

    “Emerging applications include IoT-enabled monitoring platforms, distributed industrial control systems, and privacy-preserving RCA in smart manufacturing and healthcare microservices [240].”

    From Anomaly detection and root-cause identification in microservices: a survey (2026) · cites this paper as [240]

    The Introduction (page unavailable) discusses privacy-preserving neural-network training and mentions healthcare as a domain, but it does not describe the applications claimed here. Searches for IoT monitoring, industrial control, root-cause analysis (RCA), smart manufacturing, and healthcare microservices found no passage addressing them. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

2 of the 121 references couldn’t be matched to a known paper.

Research works printed but not linked: 3

  1. F. Boemer, A. Costache, R. Cammarota, and C. Wierzynski. ngraph-he2: A high-throughput framework for neural network inference on encrypted data. In ACM WAHC, 2019.
  2. H. Corrigan-Gibbs and D. Boneh. Prio: Private, Robust, and Computation of Aggregate Statistics. In USENIX NSDI, 2017.
  3. P. Mohassel and P. Rindal. Aby 3: a mixed protocol framework for machine learning. In ACM CCS, 2018.

Cited by

Sorted by citations

Related

Authors
Sav, S., Pyrgelis, A., Troncoso-Pastoriza, J. R., Froelicher, D., Bossuat, J.-P., Sousa, J. S., & Hubaux, J.-P.
Affiliations
École Polytechnique Fédérale de Lausanne (CH)
ORCID
Venue
Proceedings 2021 Network and Distributed System Security Symposium
Publisher
Internet Society
Published
2021
DOI
10.14722/ndss.2021.24119
OpenAlex
W3082434828
Cited by
162
References
121
Citations by year
2026: 15 · 2025: 32 · 2024: 34 · 2023: 35 · 2022: 33 · 2021: 12 · 2020: 1
FWCI
13.17
Type
conference paper
Language
en
Open access
Locations
  • Network and Distributed System Security Symposium (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • Infoscience (Ecole Polytechnique Fédérale de Lausanne) (submittedVersion, cc-by-nc-nd)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Computer Science › Information Systems › Cloud Data Security Solutions
Keywords
privacy-preserving federated learning, Poseidon, neural network training, secure multi-party computation, differential privacy, membership inference attacks, data privacy, model privacy, data protection regulation, federated learning security

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review