Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Quality

Yenan Wang; Carla Fabiana Chiasserini; Elad Michael Schiller

cs.LGMar 3, 2026

Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Quality

Authors: Yenan Wang, Carla Fabiana Chiasserini, Elad Michael Schiller

Organizations: Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden

Abstract

Federated learning (FL) enables collaborative training of machine learning models without sharing sensitive client data, making it a cornerstone for privacy-critical applications. However, FL faces the dual challenge of ensuring learning quality and robust privacy protection while keeping resource consumption low, particularly when using computationally expensive techniques such as homomorphic encryption (HE). In this work, we enhance an FL process that preserves privacy using HE by integrating it with synthetic data generation and an interleaving strategy. Specifically, our solution, named Alternating Federated Learning (Alt-FL), consists of alternating between local training with authentic data (authentic rounds) and local training with synthetic data (synthetic rounds) and transferring the encrypted and plaintext model parameters on authentic and synthetic rounds (resp.). Our approach improves learning quality (e.g., model accuracy) through datasets enhanced with synthetic data, preserves client data privacy via HE, and keeps manageable encryption and decryption costs through our interleaving strategy. We evaluate our solution against data leakage attacks, such as the DLG attack, demonstrating robust privacy protection. Also, Alt-FL provides 13.4% higher model accuracy and decreases HE-related costs by up to 48% with respect to Selective HE.

Figures & tables

Fig. 1: An overview of the proposed Alternating Federated Learning ( Alt-FL ) .

Panel of Figure 2 — Fig. 2: Result of the DLG attack on a specific authentic image (a) when models are sent unencrypted (b), and encrypted with $\eta{=}0.1$ (c) and $0.2$ (d).

	Unencrypted	$\eta{=}0.1$	$\eta{=}0.2$
UQI	0.9954	0.8950	0.8712
MSSSIM	0.9640	0.7000	0.6407
VIF	0.3167	0.0629	0.0602

TABLE I: Similarity metrics for DLG attack when data is not encrypted (

\eta{=}0

), and when Selective HE is applied with different encryption ratios (no interleaving is used, i.e.,

\rho{=}0

)

	$\rho{=}0.5$ (40)	$\rho{=}0.5$ (80)	$\rho{=}0.5$ (100)	$\rho{=}0.25$ (40)	$\rho{=}0.25$ (80)	$\rho{=}0.25$ (100)
UQI	0.782 ( $\color[rgb]{0,0.6,0}-10.3\%$ )	0.779 ( $\color[rgb]{0,0.6,0}-10.6\%$ )	0.780 ( $\color[rgb]{0,0.6,0}-10.5\%$ )	0.781 ( $\color[rgb]{0,0.6,0}-10.3\%$ )	0.782 ( $\color[rgb]{0,0.6,0}-10.2\%$ )	0.779 ( $\color[rgb]{0,0.6,0}-10.6\%$ )
MSSSIM	0.537 ( $\color[rgb]{0,0.6,0}-16.1\%$ )	0.524 ( $\color[rgb]{0,0.6,0}-18.2\%$ )	0.528 ( $\color[rgb]{0,0.6,0}-17.6\%$ )	0.539 ( $\color[rgb]{0,0.6,0}-15.9\%$ )	0.527 ( $\color[rgb]{0,0.6,0}-17.7\%$ )	0.528 ( $\color[rgb]{0,0.6,0}-17.6\%$ )
VIF	0.044 ( $\color[rgb]{0,0.6,0}-26.8\%$ )	0.042 ( $\color[rgb]{0,0.6,0}-29.7\%$ )	0.042 ( $\color[rgb]{0,0.6,0}-29.8\%$ )	0.044 ( $\color[rgb]{0,0.6,0}-27.2\%$ )	0.043 ( $\color[rgb]{0,0.6,0}-29.2\%$ )	0.042 ( $\color[rgb]{0,0.6,0}-29.6\%$ )

TABLE II: Alt-FL (

\eta{=}0.2

): Avg. similarity scores during DLG attacks for different synthetic rounds (between brackets) and values of the interleaving ratio. Values between brackets report the increase in percentage w.r.t. S-HE ,

\rho{=}0

, where green text indicates better privacy and red indicates worse privacy

Panel of Figure 5 — Fig. 3: Attack launched on synthetic rounds when $\rho{=}0.5$ : exemplary authentic images (a), (c), (e) and corresponding recovered image for (resp.) max UQI (b), max MSSSIM (d), and max VIF (f).

	Convergence [#rounds]	Ciphertext [MB]	Client tot. comm. cost [MB]	Client tot. comp. time [s]	Accuracy [%]
S-HE , $\rho{=}0$	77	0.14	2.25	3340	55.58
Alt-FL , $\rho=0.25$	91 ( $\color[rgb]{0.72,0,0}+18.4\%$ )	0.13 ( $\color[rgb]{0,0.6,0}-8.3\%$ )	2.62 ( $\color[rgb]{0.72,0,0}+16.7\%$ )	3967 ( $\color[rgb]{0.72,0,0}+18.8\%$ )	61.04 ( $\color[rgb]{0,0.6,0}+9.8\%$ )
Alt-FL , $\rho=0.5$	92 ( $\color[rgb]{0.72,0,0}+20.5\%$ )	0.08 ( $\color[rgb]{0,0.6,0}-39.1\%$ )	2.62 ( $\color[rgb]{0.72,0,0}+16.8\%$ )	4036 ( $\color[rgb]{0.72,0,0}+20.8\%$ )	63.02 ( $\color[rgb]{0,0.6,0}+13.4\%$ )

TABLE III: Averaged training costs for Alt-FL and its benchmarks: no. of rounds needed for model convergence, total no. of ciphertext Mbytes, per-client total no. of transmitted Mbytes and computational time, and achieved accuracy level. Values between brackets report the increase in percentages w.r.t. S-HE ,

\rho{=}0

, where the green text indicates better performance and red indicates worse performance

Fig. 4: The LeNet5 model’s accuracy of Alt-FL and its benchmarks until convergence. Stars markers denote the round at which schemes reached peak accuracy.

Fig. 5: Encryption and decryption time with encryption ratio

\eta{=}0.2

Privacy-Preserving ML

Privacy-preserving machine learning develops methods to learn, share, and run models while limiting exposure of sensitive data.

See all 423 papers

Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques
Mar 5, 2026Yenan Wang, Carla Fabiana Chiasserini, Elad Michael SchillerFederated Learning Differentially Private Federated Learning
Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden
A Privacy-Preserving Federated Learning Method for Heterogeneous Clients
Nov 8, 2025Yusaku Negoya, Feifei Cui, Zilong Zhang +3Privacy-Preserving Federated Learning Differentially Private Federated Learning
Department of Computer and Network Engineering, The University of Electro-Communications, Tokyo, Japan · School of Computer Science and Technology, Hainan University, Haikou 570228, China. · Department of Electrical and Computer Engineering, University of Houston, Houston, TX, 77204, USA +1
Pushing Forward Multi-Secret-Key Homomorphic Encryption for Private Average Aggregation
Sep 1, 2026Miguel Morona-Mínguez, Fernando Pérez-González, Alberto Pedrouzo-UlloaFederated Learning Aggregation Homomorphic Encryption
aatlanTTic, Universidade de Vigo, Escola de Enxeñaría de Telecomunicación, Vigo, 36310, Galicia, Spain

Mar 5, 2026J/K move · Enter open · S save

Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques

Yenan Wang, Carla Fabiana Chiasserini, Elad Michael Schiller

Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden

Federated Learning Differentially Private Federated Learning

Open paper AskPDF arXiv

In federated learning (FL), balancing privacy protection, learning quality, and efficiency remains a challenge. Privacy protection mechanisms, such as Differential Privacy (DP), degrade learning quality, or, as in the case of Homomorphic Encryption (HE), incur substantial system overhead. To address this, we propose Alt-FL, a privacy-preserving FL framework that combines DP, HE, and synthetic data via a novel round-based interleaving strategy. Alt-FL introduces three new methods, Privacy Interleaving (PI), Synthetic Interleaving with DP (SI/DP), and Synthetic Interleaving with HE (SI/HE), that enable flexible quality-efficiency trade-offs while providing privacy protection. We systematically evaluate Alt-FL against representative reconstruction attacks, including Deep Leakage from Gradients, Inverting Gradients, When the Curious Abandon Honesty, and Robbing the Fed, using a LeNet-5 model on CIFAR-10 and Fashion-MNIST. To enable fair comparison between DP- and HE-based defenses, we introduce a new attacker-centric framework that compares empirical attack success rates across the three proposed interleaving methods. Our results show that, for the studied attacker model and dataset, PI achieves the most balanced trade-offs at high privacy protection levels, while DP-based methods are preferable at intermediate privacy requirements. We also discuss how such results can be the basis for selecting privacy-preserving FL methods under varying privacy and resource constraints.

Abstract

Privacy-Preserving ML

Explore similar work

Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques

A Privacy-Preserving Federated Learning Method for Heterogeneous Clients

Pushing Forward Multi-Secret-Key Homomorphic Encryption for Private Average Aggregation