Combating Deep Leakage from Gradients in Cross-Silo Federated Learning with QKD

Deep Leakage from Gradients (DLG) could reveal training data privacy from gradients transmitted over an insecure channel in Cross-Silo Federated Learning (CSFL) systems. So far, One-Time Pad (OTP) based on secret keys generated by Quantum Key Distribution (QKD) is the only perfectly secure approach to defending channel security and preserving privacy. Nevertheless, current QKD systems cannot generate keys at a rate high enough to support OTP in practical CSFL systems, while we find that encrypting only part of the gradients or several bits of each gradient is not adequate to preserve data privacy. To overcome these challenges, we propose QuGrad to encrypt each gradient using only one bit of secret keys. In QuGrad, it is unpredictable which or how many bits of each gradient will be changed and the encrypted gradient vector will be orthogonal to the original one, which potentially hides the maximum amount of training data information. By implementing QuGrad on a testbed and conducting extensive experiments, we show that QuGrad can reduce the average Jaccard similarity between the recovered data and the original ones by up to 89% compared with the state-of-the-art technique to defend training data against DLG.