NID: A privacy-preserving operator based on Neural Information Diffusion

Gradient inversion attacks (GIAs) pose a significant privacy threat to distributed learning paradigms, aiming to reconstruct the victim’s training data with high fidelity through shared gradients. To mitigate this issue, numerous privacy-preserving strategies have been proposed, yet few methods achieve a balance between efficiency, utility and privacy. In this paper, we will explore the limitations of the widely adopted privacy-preserving method in distributed learning, i.e., Local Differential Privacy (LDP), and expose that there is a discrepancy between the conceptualization of privacy budget and its practical application against gradient leakage attacks; simultaneously, we will reveal that under imbalanced data distributions, privacy-preserving methods based on random perturbations inevitably exacerbate the degradation of model performance. To alleviate these issues, we propose a plug-and-play privacy protection method based on Neural Information Diffusion (NID). In our approach, participants in training need only diffuse neural information in an unbiased manner, thus ensuring the privacy through propagatable randomness. We have evaluated our method in privacy-vulnerable scenarios and thoroughly demonstrated its effectiveness in resisting GIAs. Meanwhile, a comprehensive array of experimental configurations robustly shows that NID possesses the capability to balance model utility and privacy.