Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques

Yenan Wang; Carla Fabiana Chiasserini; Elad Michael Schiller

cs.LGMar 5, 2026

Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques

Authors: Yenan Wang, Carla Fabiana Chiasserini, Elad Michael Schiller

Organizations: Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden

Abstract

In federated learning (FL), balancing privacy protection, learning quality, and efficiency remains a challenge. Privacy protection mechanisms, such as Differential Privacy (DP), degrade learning quality, or, as in the case of Homomorphic Encryption (HE), incur substantial system overhead. To address this, we propose Alt-FL, a privacy-preserving FL framework that combines DP, HE, and synthetic data via a novel round-based interleaving strategy. Alt-FL introduces three new methods, Privacy Interleaving (PI), Synthetic Interleaving with DP (SI/DP), and Synthetic Interleaving with HE (SI/HE), that enable flexible quality-efficiency trade-offs while providing privacy protection. We systematically evaluate Alt-FL against representative reconstruction attacks, including Deep Leakage from Gradients, Inverting Gradients, When the Curious Abandon Honesty, and Robbing the Fed, using a LeNet-5 model on CIFAR-10 and Fashion-MNIST. To enable fair comparison between DP- and HE-based defenses, we introduce a new attacker-centric framework that compares empirical attack success rates across the three proposed interleaving methods. Our results show that, for the studied attacker model and dataset, PI achieves the most balanced trade-offs at high privacy protection levels, while DP-based methods are preferable at intermediate privacy requirements. We also discuss how such results can be the basis for selecting privacy-preserving FL methods under varying privacy and resource constraints.

Figures & tables

Fig. 1: Overview of the proposed Alt-FL schemes (left) vs. the baseline Mixed Protections (right).

Panel of Figure 2 — Fig. 2: Comparison of ciphertext size (left), encryption time (middle), and combined decryption and aggregation time (right) across HE, MIFE, and DMCFE schemes. (a) linear-scale x-axis. (b) logarithmic-scale x-axis.

Fig. 3: Attack success rates (ASR) on model protected by DP (varying noise) and/or S-HE (varying encryption ratio) for each studied attack. Success rates are rounded to the nearest percent, and 0% success rates are omitted for clarity.

Panel of Table 4 — TABLE I: DP noise multipliers $\sigma$ selected for each encryption ratio $\eta$ for all privacy levels (PL)

$\sigma$	0.05	0.1	0.25	0.5	0.75	1
Mantissa	1.17	1.47	1.09	5.36	1.25	6.63
Exponent	$10^{5}$	$10^{4}$	$10^{3}$	$10^{1}$	$10^{1}$	$10^{0}$

TABLE II: Average cumulative privacy budget

\varepsilon

at convergence for noise multipliers

\sigma\geq 0.05

Fig. 4: Average cumulative privacy budget

\varepsilon

at convergence as a function of the noise multiplier

\sigma

Fig. 5: All methods and configurations with a success rate of 0.5% or lower are shown. The legend on the right lists the corresponding methods and levels of non-IIDness. Each symbol appears once for every configuration whose success rate does not exceed 0.5%.

Std-1.0 to Std-0.25	SI/DP, PI * , MP *	SI/DP, PI * , MP *	SI/DP, PI * , MP *
	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Std-0.1	PI,
MP: $\eta\in\{0.2,0.4,0.6,1\}$	SI/DP,
PI (excl. $\rho=1$ ),
MP (excl. $\eta=1$ )	SI/DP, PI, MP
Supremum	SI/HE, PI, MP	SI/DP, SI/HE,

TABLE III: Methods and their configurations that provide the best defenses against the privacy attacks under varying data distribution, with

t_{asr}=0.5\%

. Note that the case with synthetic augmentation is identical to

\alpha{=}0.5

. Methods marked with

*

are those in which the chosen configurations vary by at most two configurations across different privacy levels

Fig. 6: Bar charts of accuracies and system costs for the methods and configurations that meet the threshold

t_{asr}{=}0.01

. For each privacy level and non-IIDness parameter

\alpha

, black error bars indicate the best and worst metrics, while colored bars represent the median values. The

r{=}0.25

corresponds to the synthetic data augmentation case.

Fig. 7: Bar charts of accuracies and system costs for the methods and configurations that meet all of the thresholds

t_{asr}{=}0.01

t_{acc}{=}0.04

, and

t_{sc}{=}0.2

. For each privacy level and non-IIDness parameter

\alpha

, black error bars indicate the best and worst metrics, while colored bars represent the median values. The

r{=}0.25

corresponds to synthetic data augmentation case.

	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Std-1.0 to
Std-0.5	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$
Std-0.25
Std-0.1	DP (SI/DP, PI, MP)	DP (SI/DP, PI, MP)	SI/DP * : $\rho\in\{0,\tfrac{1}{4}\}$ ,
DP (SI/DP, PI, MP)
Supremum	DP (PI, MP)	DP (SI/DP, PI)	SI/DP: $\rho\in\{0,\tfrac{1}{4}\}$ ,

TABLE IV: Methods and their configurations that can balance between accuracy and system costs while preserving privacy (only configurations that meet the thresholds

t_{asr}{=}0.01

t_{acc}{=}0.04

, and

t_{sc}{=}0.5

are included). Methods marked with * are those in which the chosen configurations vary by at most two configurations across different privacy levels

Fig. 8: Bar charts of attack success rates and system costs for the methods and configurations that meet the threshold

t_{acc}{=}0.1

. For each privacy level and non-IIDness parameter

\alpha

, black error bars indicate the best and worst metrics, while colored bars represent the median values. The

r{=}0.25

corresponds to synthetic data augmentation case.

Fig. 9: Bar charts of attack success rates and system costs for the methods and configurations that meet the threshold

t_{acc}{=}0.1

t_{asr}{=}0.005

, and

t_{sc}{=}0.5

. For each privacy level and non-IIDness parameter

\alpha

, black error bars indicate the best and worst metrics, while colored bars represent the median values. The

r{=}0.25

corresponds to synthetic data augmentation case.

	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Std-1.0	PI: $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\frac{3}{4}\}$	PI: $\rho\in\{\tfrac{2}{5},\tfrac{1}{2},\frac{3}{5}\}$	PI: $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\frac{3}{4}\}$
Std-0.75 to Std-0.5	DP (SI/DP, PI, MP)	DP * (SI/DP, PI, MP)	DP * (SI/DP, PI, MP)
Std-0.25	SI/DP: $\rho=\tfrac{1}{4}$	SI/DP: $\rho\in\{0,\tfrac{1}{4}\}$ ,
DP (SI/DP, PI)	SI/DP: $\rho=\tfrac{1}{4}$ ,
DP (SI/DP, PI, MP)
Std-0.1	DP (PI)	SI/DP: $\rho\in\{\tfrac{1}{4},\tfrac{2}{5}\}$	SI/DP: $\rho\in\{\tfrac{1}{4},\tfrac{2}{5}\}$ ,

TABLE V: Methods and their configurations that can balance between attack success rates and system costs while maintaining an adequate level of accuracy (only the configurations meeting the thresholds

t_{acc}=0.1

t_{asr}=0.005

, and

t_{sc}=0.5

are presented). Methods marked with * are those in which the chosen configurations vary by at most two configurations across different privacy levels

Panel of Table 15 — TABLE VI: DP noise multipliers $\sigma$ selected for each encryption ratio $\eta$ for all privacy levels (PL) using Fashion-MNIST

Fig. 10: Bar charts of accuracies and system costs for the methods and configurations that meet the threshold

t_{asr}{=}0.01

when trained on Fashion-MNIST. For each privacy level and non-IIDness parameter

\alpha

, black error bars indicate the best and worst metrics, while colored bars represent the median values. The

r{=}0.25

corresponds to the synthetic data augmentation case.

	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Std-1.0 to Std-0.1	SI/DP, PI * , MP *	SI/DP, PI * , MP *	SI/DP, PI * , MP *
Supremum	SI/HE, PI, MP (excl. $\eta=1$ )	SI/DP, SI/HE,
PI (excl. $\rho\in\{\tfrac{1}{2},\tfrac{3}{5}\}$ ),
MP	SI/HE,
PI (excl. $\rho\in\{\tfrac{1}{2},\tfrac{3}{5}\}$ ),
MP

TABLE VII: Methods and their configurations that provide the best defenses against the privacy attacks under varying data distribution, with

t_{asr}=0.5\%

using Fashion-MNIST. Note that the case with synthetic augmentation is identical to

\alpha{=}0.5

. Methods marked with

*

are those in which the chosen configurations vary by at most two configurations across different privacy levels

	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Std-1.0 to
Std-0.5	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$	PI * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\tfrac{3}{4}\}$
Std-0.25	DP (SI/DP, PI, MP)	DP (SI/DP, PI, MP)	SI/DP: $\rho\in\{0,\tfrac{1}{4}\}$ ,
DP (SI/DP, PI, MP)
Std-0.1	SI/DP: $\rho\in\{\tfrac{2}{5},\tfrac{1}{2}\}$	SI/DP: $\rho=\tfrac{2}{5}$ ,
DP (PI)	SI/DP: $\rho\in\{0,\tfrac{2}{5},\tfrac{1}{2}\}$ ,

TABLE VIII: Methods and their configurations that can balance between accuracy and system costs while preserving privacy using Fashion-MNIST (only configurations that meet the thresholds

t_{asr}{=}0.01

t_{acc}{=}0.04

, and

t_{sc}{=}0.5

are included). Methods marked with * are those in which the chosen configurations vary by at most two configurations across different privacy levels

Std-1.0 to Std-0.1	SI/DP * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\frac{3}{4}\}$	SI/DP * : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\frac{3}{4}\}$	SI/DP * : : $\rho\in\{\tfrac{1}{2},\tfrac{3}{5},\frac{3}{4}\}$
	$\alpha=0.25$	$\alpha=0.5$	$\alpha=1$
Supremum	DP (PI)	SI/DP: $\rho\in\{\tfrac{3}{5},\tfrac{3}{4}\}$	DP (MP)
DLG/Inverting	SI/DP: $\rho\in\{\tfrac{3}{5},\tfrac{3}{4}\}$	SI/DP: $\rho\in\{\tfrac{3}{5},\tfrac{3}{4}\}$	SI/DP: $\rho\in\{\tfrac{3}{5},\tfrac{3}{4}\}$
RTF	MP: $\eta\in\{0.4,0.6\}$	MP: $\eta\in\{0.4,0.6\}$	MP: $\eta\in\{0.4,0.6\}$
CAH	SI/HE: $\rho=\tfrac{3}{4}$	SI/HE: $\rho=\tfrac{3}{4}$	SI/HE: $\rho=\tfrac{3}{4}$
Infimum	HE (MP)	HE (MP)	HE (MP)

TABLE IX: Methods and their configurations that can balance between attack success rates and system costs while maintaining an adequate level of accuracy using Fashion-MNIST (only the configurations meeting the thresholds

t_{acc}=0.1

t_{asr}=0.005

, and

t_{sc}=0.5

are presented). Methods marked with * are those in which the chosen configurations vary by at most two configurations across different privacy levels

Fig. 11: Objective-oriented selection process of the studied methods (represented as blue parallelograms) based on the recommendations derived from our results. The green rhombuses show the prioritized criteria.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
$\rho$	Interleaving ratio.
$\eta$	Encryption ratio for S-HE.
$\sigma$	Noise multiplier parameter in DP mechanisms.
$C$	Maximum gradient clipping norm.
$\alpha$	Non-IIDness parameter for Dirichlet distribution.
$r$	Synthetic data augmentation ratio.

Appendix

Table 21

Federated Learning

Federated learning trains shared models across data holders without requiring them to pool their raw data.

See all 921 papers

Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Quality
Mar 3, 2026Yenan Wang, Carla Fabiana Chiasserini, Elad Michael SchillerPrivacy-Preserving ML Federated Learning
Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden
IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning
Jun 1, 2026Farhin Farhad Riya, Olivera Kotevska, Jinyuan Stella SunFederated Learning Aggregation Privacy-Preserving ML
University of Tennessee, Knoxville, USA · Oak Ridge National Laboratory, USA
Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning
Jun 15, 2026Xiaolin Li, Ning Wang, Ninghui Li +1Backdoor Attacks in Federated Learning Differentially Private Federated Learning
Purdue University West Lafayette, IN, USA · University of South Florida Tampa, FL, USA

Mar 3, 2026J/K move · Enter open · S save

Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Quality

Yenan Wang, Carla Fabiana Chiasserini, Elad Michael Schiller

Computer Science and Engineering, Chalmers University of Technology, Gothenburg, Sweden

Privacy-Preserving ML Federated Learning Homomorphic Encryption

Open paper AskPDF arXiv

Federated learning (FL) enables collaborative training of machine learning models without sharing sensitive client data, making it a cornerstone for privacy-critical applications. However, FL faces the dual challenge of ensuring learning quality and robust privacy protection while keeping resource consumption low, particularly when using computationally expensive techniques such as homomorphic encryption (HE). In this work, we enhance an FL process that preserves privacy using HE by integrating it with synthetic data generation and an interleaving strategy. Specifically, our solution, named Alternating Federated Learning (Alt-FL), consists of alternating between local training with authentic data (authentic rounds) and local training with synthetic data (synthetic rounds) and transferring the encrypted and plaintext model parameters on authentic and synthetic rounds (resp.). Our approach improves learning quality (e.g., model accuracy) through datasets enhanced with synthetic data, preserves client data privacy via HE, and keeps manageable encryption and decryption costs through our interleaving strategy. We evaluate our solution against data leakage attacks, such as the DLG attack, demonstrating robust privacy protection. Also, Alt-FL provides 13.4% higher model accuracy and decreases HE-related costs by up to 48% with respect to Selective HE.

Abstract

Federated Learning

Explore similar work

Integrating Homomorphic Encryption and Synthetic Data in FL for Privacy and Learning Quality

IntraShuffler: A Privacy Preserving Framework for Heterogeneous DP Federated Learning

Your Privacy My Cloak: Backdoor Attacks on Differentially Private Federated Learning