Jul 2026· European Symposium on Security and Privacy· pp. 608-619· 0 citations· 30 references
Abstract
Federated Recommender Systems (FRSs) enable on-device personalization while preserving user privacy, yet the gradients shared during model training can still leak sensitive information. Local differential privacy (LDP) offers a formal defense, but classic mechanisms—randomized response and Laplace perturbation—inject substantial noise into the high-dimensional gradient vectors of latent-factor models, severely degrading recommendation accuracy. In this paper, we systematically evaluate these traditional LDP strategies in federated matrix factorization under both explicit (MovieLens 100K and 1M) and implicit (Steam, LastFM) feedback benchmarks. We then propose a novel directional noise mechanism based on the von Mises–Fisher distribution, which preserves gradient magnitudes while randomizing directions. Through extensive experiments across a wide range of privacy budgets, we show that our vMF mechanism consistently outperforms Laplace and binary randomized-response, recovering up to more than 100 % of the non-private utility at ε = 1 and delivering higher ranking accuracy under moderate privacy levels (ε ≤ 2). We further demonstrate that directional perturbation reduces variance and remains robust under partial client participation. Our findings highlight the importance of data geometry in privacy–utility trade-offs and provide practical guidance for deploying LDP in high-dimensional federated recommendation settings.
Differential privacy (DP) mechanisms have been widely adopted in federated learning (FL) to enhance model security. However, existing approaches predominantly employ uniform privacy budgets, neglecting personalized requirements arising from heterogeneous user privacy preferences. Such uniform privacy configurations typically necessitate compliance with the most stringent budget, which not only leads to the wasteful underutilization of privacy budgets for certain clients but also compromises overall model utility. To address this limitation, we propose FedSPA, a Subspace Projection Aggregation personalized differential private Federated learning framework. The proposed method conducts singular value decomposition operations on noise-perturbed local models to extract singular value vectors as compact representations of both model structure and privacy noise. The server then clusters clients and identifies a consensus subspace for projecting models with varying noise levels, ultimately aggregating the global model through a residual-aware mechanism. This method not only effectively guides the aggregation of client personalized differential privacy but also reduces communication overhead. Extensive experiments demonstrate the model's effectiveness. Additionally, we provide theoretical proof of the privacy and convergence of FedSPA. Experimental results also showcase its superior performance over personalized DP-FL baselines.
Tianchi Liao, Xiaojun Deng, Lele Fu et al.· Proceedings of the 32nd ACM...· 0 citations
This work presents and evaluates a privacy-preserving recommendation framework that combines federated learning, differential privacy, cohort-level modeling, and privacy-aware intelligent agents, offering a scalable approach for next-generation AI-driven retail platforms.
Ranjeet K Jha, Venkata Suresh Gummadilli· 0 citations
i-FedLoRA provides privacy guarantees, improves model accuracy by up to 3.8%, and expedites training by 1.37-2.23×, and facilitates heterogeneous LoRA aggregation that selectively prioritizes high-confidence knowledge to filter DP-induced noise, thereby achieving robust knowledge transfer.
Nan Yan, Yuqing Li, Xiong Wang et al.· Proceedings of the 32nd ACM...· 0 citations
CoP is proposed, a coordinated perturbation mechanism designed to mitigate CIL in multidimensional data collection while preserving utility and significantly outperforms state-of-the-art LDP mechanisms in reducing disclosure while preserving analytical accuracy.
Sandaru Jayawardana, Ming Ding, Kanchana Thilakarathna· Proceedings on Privacy Enhan...· 0 citations
Federated Learning (FL) avoids centralizing raw data, but server-side access to per-client updates still creates a significant privacy risk because gradients can leak sensitive information through inversion and related attacks. A common defense is client-level Differential Privacy (DP), which reduces attack fidelity by perturbing individual updates, but often at the cost of degraded predictive utility, especially in heterogeneous settings. In this paper, we study a different design choice: aggregate-only observability, where the server learns only an aggregate update rather than the individual client contributions that compose it. We develop a unified evaluation framework comparing baseline FL, client-level DP-FL, an idealized sum-only aggregation mechanism (hide_sum), and a quantum-inspired aggregate-observation primitive (qsum) based on finite-shot GHZ-style phase estimation. Experiments on Texas PUDF and MIMIC-IV show that the aggregate-only regimes preserve competitive predictive utility relative to baseline FL while removing the direct per-client observation channel used by standard server-side inversion attacks. We also analyze utility sensitivity to shot budgets and the resource scaling of the quantum-inspired primitive. The results suggest that privacy–utility tradeoffs in FL depend not only on how updates are perturbed, but also on what the server is allowed to observe. Aggregate-only observability therefore provides a useful mechanism-level complement to noise-based privacy defenses, while also motivating hybrid designs to address residual leakage from aggregate updates.
Clifford N. Jones, Md Nahid Hasan, S. Wagle et al.· International Conference on...· 0 citations
Federated Learning (FL) enables distributed training while keeping data local, but exchanged model updates can leak information through membership inference attacks. Differential privacy mitigates this risk via noise injection; however, aggressive DP regimes with strong noise can destabilize large models. An SNR-guided framework is introduced to select model dimensionality based on the signal-to-noise ratio imposed by the privacy budget. Three optimizers, DP-FedAvg, DP-FedAvgM, and DP-FedAdam, are evaluated across six domains, including image, clinical, IoT, and network security tasks. Privacy leakage is assessed using both loss-based membership inference and the likelihood-ratio attack LiRA. DP-FedAvgM achieves 98.10% accuracy on MNIST at ε =200 with LiRA AUC near random guessing (0.491). SNR-guided models reduce communication cost by up to 66×. Sensitivity calibration experiments further show that incorrect noise allocation can reduce accuracy by up to 1.36 percentage points. These results highlight the importance of model sizing and noise calibration for reliable privacy-preserving FL under strong DP constraints.
Mohammed Hamza, I. B. Sofi, Kuljeet Kaur et al.· International Conference on...· 0 citations