Designing for Privacy in Tabular Federated Learning
Abstract
In federated learning (FL), private data leakage through gradient inversion depends strongly on design choices and data properties. We study this risk under an honest-but-curious server threat model, with a focus on clinical tabular data from MIMIC-IV and complementary benchmark tasks for binary classification, multiclass classification, and regression. Unlike image reconstruction, tabular reconstruction cannot be judged well by visual inspection. Evaluation must account for numerical tolerances, categorical exact matches, baseline recoverability, and the difference between feature level recovery and exact row recovery. We evaluate FedSGD gradients and FedAvg model deltas using an exposure aligned training protocol, where attacked models are compared after matched client data exposure rather than matched communication rounds. We compare MLP, ResNet, and FT-Transformer models, and isolate architecture effects further through an MLP grid over width, depth, activation, normalization, and dropout. The results show that local aggregation and client data exposure are among the strongest determinants of tabular gradient leakage. Small client batches and updates representing few distinct records are most vulnerable, while stronger local aggregation and greater client data exposure usually reduce reconstruction in ways that vary across architectures and datasets. FT-Transformer is consistently harder to invert than the MLP and ResNet baselines, suggesting that embedded categorical…
Read the paper
Related studies
- Active Learning during Federated Learning for Object Detection
- Fairness-aware federated learning
- Decentralized Federated Learning
- Building a Personally Identifiable Information Recognizer in a Privacy Preserved Manner Using Automated Annotation and Federated Learning
- Preservation of Patient Level Privacy: Federated Classification and Calibration Models
- Efficient explainable federated learning
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.