Post-doctoral Research Visit F/m Privacy-preserving

Le descriptif de l’offre ci-dessous est en Anglais_

**Type de contrat **:CDD

**Contrat renouvelable **:Oui

**Niveau de diplôme exigé **:Thèse ou équivalent

**Fonction **:Post-Doctorant

**A propos du centre ou de la direction fonctionnelle**:
The Inria centre at Université Côte d'Azur includes 37 research teams and 8 support services. The centre's staff (about 500 people) is made up of scientists of different nationalities, engineers, technicians and administrative staff. The teams are mainly located on the university campuses of Sophia Antipolis and Nice as well as Montpellier, in close collaboration with research and higher education laboratories and establishments (Université Côte d'Azur, CNRS, INRAE, INSERM...), but also with the regiona economic players.

With a presence in the fields of computational neuroscience and biology, data science and modeling, software engineering and certification, as well as collaborative robotics, the Inria Centre at Université Côte d'Azur is a major player in terms of scientific excellence through its results and collaborations at both European and international levels.

**Contexte et atouts du poste**:
not applicable

**Mission confiée**:
Context:
Federated Learning (FL) empowers a multitude of devices, including mobile phones and sensors, to collaboratively train a global machine learning model while retaining their data locally [1,2]. A prominent example of FL in action is Google's Gboard, which uses a FL-trained model to predict subsequent user inputs on smartphones [3].

Two primary challenges arise during the training phase of FL [4]:
**_ Data Privacy_**: _How to ensure user data remains confidential?_ Even though the data is kept locally by the devices, it has been shown that an honest-but-curious server can still reconstruct data samples [5,6], sensitive attributes [7,8], and the local model [9] of a targeted device. Moreover, the server can perform membership inference attacks [10] to identify whether a data sample was used in training or source inference attacks to determine which device stores a given data sample [11].

**_ Security Against Malicious Participants_**: _How to ensure the learning process is not derailed by harmful actors?_ Recent research has demonstrated that, in the absence of protective measures, a malicious agent can deteriorate model performance by simply flipping the labels [12] and/or the sign of the gradient [13], and even inject backdoors into the model [14] (backdoors are hidden vulnerabilities that can be exploited under certain conditions predefined by the attacker, such as specific inputs).

To enhance system security against adversarial threats, Byzantine resilient mechanisms are implemented on the server side. These algorithms are designed to identify and mitigate potentially detrimental actions or inputs from users, ensuring that even if some components act maliciously or erratically, the overall system remains functional and secure [21,22,23,24]. Experiments [21] reveal that integrating these Byzantine resilient mechanisms sustains neural network accuracy at 90.7%, even when 10% of the agents maliciously flip the labels on the MNIST dataset. In contrast, without such protection, the accuracy of the neural network drops significantly to 77.3%.

Integrating differential privacy with Byzantine resilience presents a notable challenge. Recent research suggests that when these two security measures are combined in their current forms, the effectiveness of the resulting algorithm disproportionately depends on the number of parameters (d) in the machine learning model [25]. In particular, it requires either the batch size to grow proportionally to the square root of d, or the proportion of the malicious agents in the system to decrease inversely proportional to the square root of d. For a realistic model such as ResNet-50 (with around 25 million parameters), the batch size should be larger than 5000, which is clearly impractical. To tackle this problem, novel Byzantine resilient algorithms have been recently proposed [26,27]. However, these algorithms encounter significant computational complexity, proportional to d3, at each communication round. **Hence, there is a pressing need for innovative methods that can seamlessly integrate differential privacy and Byzantine resilience with low computational complexity to train practical neural networks.**

Objective

In this project, we aim to propose novel FL algorithms to effectively tackle these two mutually linked challenges.

In particular we want to explore the potentialities of **compression** in FL training, as these techniques can highly reduce the model dimension, which **may provide a solution for a **_computation-efficient,_** **_private,_** and **_secure_** FL system.**

Compression techniques were initially introduced to alleviate communication costs in distributed training processes, where only a proportion of model parameters are sent from the device to the serv