Aghiles Ait Messaoud
email: aghiles.ait-messaoud@insa-lyon.fr

Sonia Ben Mokhtar
email: sonia.benmokhtar@insa-lyon.fr

Vlad Nitu
email: vlad.nitu@integrate.ai

Valerio Schiavoni
email: valerio.schiavoni@unine.ch

Shielding Federated Learning Systems against Inference Attacks with ARM TrustZone

Keywords: Federated Learning, privacy, Trusted Execution Environment, TrustZone

published or not. The documents may come

L'archive ouverte

INTRODUCTION

Federated learning (FL) is a distributed machine learning (ML) approach with increasing adoption from academia and industry [START_REF] Kallista | Towards Federated Learning at Scale: System Design[END_REF]. The main advantage of this approach is to train ML models while keeping private user data (photos, vocal recording, purchase data, etc.) under the control of their owners, e.g., end users. In a nutshell, a server distributes a global model to several clients. In turn, they train such model locally with their data, and send back the model gradients (i.e., updates) to the server. The latter aggregates the received gradients and iterates by sending the resulting global model to the clients, until a given accuracy is reached. However, the long list of recent privacy attacks (e.g., [START_REF] Melis | Exploiting Unintended Feature Leakage in Collaborative Learning[END_REF][START_REF] Nasr | Comprehensive Privacy Analysis of Deep Passive and Active White-box Inference Attacks against Centralized and Federated Learning[END_REF][START_REF] Zhu | Deep Leakage from Gradients[END_REF]) demonstrates that sharing model gradients in the context of FL training constitutes a threat to clients' privacy. Indeed, model gradients may leak sensitive information enabling, for instance, the reconstruction of raw data samples [START_REF] Hongxu Yin | See Through Gradients: Image Batch Recovery via GradInversion[END_REF][START_REF] Zhu | Deep Leakage from Gradients[END_REF] or the learning of hidden features about the data of participating users [START_REF] Melis | Exploiting Unintended Feature Leakage in Collaborative Learning[END_REF] (e.g., gender, race, etc.). Such attacks threaten the main motivation behind using FL, e.g., the preservation of users' privacy. Hence, it is paramount to reduce the impact of such attacks, in particular by securing the model gradients and their computation. Many software solutions exist to secure the gradients on the server-side. For instance, secure aggregation [START_REF] Kallista | Practical Secure Aggregation for Federated Learning on User-Held Data[END_REF] forces the server to only observe the aggregated gradients instead of the individual ones. Differential-privacy [START_REF] Dwork | Differential Privacy: A Survey of Results[END_REF][START_REF] Wei | Federated learning with differential privacy: Algorithms and performance analysis[END_REF] (DP) adds noise to the client gradients before sending them to the server. Finally, homomorphic encryption [START_REF] Fang | Privacy preserving machine learning with homomorphic encryption and federated learning[END_REF] leverages aggregation on homomorphically encrypted gradients. The previous techniques mask the individual raw gradients to the server, to prevent launching privacy attacks from it. However, despite their proven efficiency, these methods do not prevent privacy attacks launched by compromised or malicious clients, and in case of DP, the built model necessarily loses some accuracy. The scenario of compromised or malicious client is particularly threatening when one deals with millions of lines of code (such as the Android OS powering billions of devices [START_REF] Bradshaw | Android now powers over 3 billion devices[END_REF]), exposing a large attack surface.

To guarantee integrity and confidentiality of FL training, one can rely on Trusted Execution Environments [START_REF] Sabt | Trusted Execution Environment: What It is, and What It is Not[END_REF] (TEEs). These are recent turn-key solutions that provide program execution with integrity and confidentiality guarantees, available from all major CPU vendors: e.g., ARM TrustZone [START_REF] Pinto | Demystifying arm trustzone: A comprehensive survey[END_REF], Intel SGX [START_REF] Costan | Intel sgx explained[END_REF], AMD SEV [START_REF] Kaplan | AMD memory encryption[END_REF]. Typically, TEEs can execute secure enclaves, shielding read and write access to an application's protected code and data against malicious user applications, compromised OS or system libraries, and even against physical attacks. TEEs have been successfully used in a plethora of application domains: design of DRM (Digital Right Management) to restricts access to intellectual property protected by copyright [START_REF] Jang | SeCReT: Secure Channel between Rich Execution Environment and Trusted Execution Environment[END_REF], emulate a secure NFC card for mobile payment [START_REF] Umar | Trusted Execution Environment and Host Card Emulation[END_REF], shield biometric authentication process [START_REF] Bhargav-Spantzel | Trusted Execution Environment for Privacy Preserving Biometric Authentication[END_REF], etc. In this paper, we rely on ARM TrustZone to mitigate client-side inference attacks in the FL context. Noteworthy, a large portion of ARM-enabled mobile devices offer native support to TrustZone, making it the most pervasive mobile architecture ranging from sensors, wearables and smartphones to supercomputers [START_REF] Arm | Arm CPU Architecture: A Foundation for Computing Everywhere[END_REF], encompassing a significant part of the FL clients. One of the challenges in using TrustZone relates to the amount of secure memory typically available to trusted applications (TA). In fact, TA can only use few MBs of secure memory (in the order of 3-5MB [START_REF] Amacher | On the Performance of ARM TrustZone -(Practical Experience Report)[END_REF]), as well as inducing additional CPU overhead.

Existing work (i.e., DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF]) secures a subset of deep neural network (DNN) layers inside TrustZone enclaves. However, DarkneTZ lacks support to secure non-successive layers of the underlying DNN model. Our experiments (see §8) prove that such feature is required to protect simultaneously against two privacy attacks targeting separate elements of a model (i.e., the convolutional and the dense parts).

We present GradSec, a framework that leverages Trust-Zone to secure, at training time, weights or filters of dense [START_REF] Bosagh | Fully Connected Deep Networks[END_REF] or convolutional [START_REF] Brownlee | How Do Convolutional Layers Work in Deep Learning Neural Networks[END_REF] layers as well as their inputs, outputs and associated computations, by shielding the gradients computation inside enclaves and from external attackers. Grad-Sec can shield non-successive layers, heavily reducing the TEE-related overhead.

GradSec can also change the protected layers across FL cycles, based on a statically fixed probability distribution, to offer a horizontal protection to a model, by going through all subset of layers, without having to secure them all at a given point of time. In a nutshell, GradSec supports two execution modes: (1) static: a subset of DNN layers (i.e., one or two separate slices, where a slice is defined as a set of successive layers), to be protected on client-side, is fixed in advance; and (2) dynamic: the protected layers change over the FL cycle through a sliding window.

We implemented GradSec on top of OP-TEE and deployed on a Raspberry Pi 3B+, with full support for TrustZone. We test the security efficiency of GradSec against three stateof-the-art privacy attacks: Data-Reconstruction Inference Attack [START_REF] Zhu | Deep Leakage from Gradients[END_REF] (DRIA), Membership Inference Attack [START_REF] Nasr | Comprehensive Privacy Analysis of Deep Passive and Active White-box Inference Attacks against Centralized and Federated Learning[END_REF] (MIA) and Data-Property Inference Attack [START_REF] Melis | Exploiting Unintended Feature Leakage in Collaborative Learning[END_REF] (DPIA). We later show that static GradSec successfully reduces the impact of DRIA, MIA or both at same time. In the latter case, our approach imposes a smaller CPU and TEE memory overhead than DarkneTZ (8% and 30% smaller respectively), as it only requires to secure a subset of the layers (i.e., the head and the tail) without the intermediate ones. In addition, dynamic GradSec reduces the impact of DPIA while maintaining only few protected layers in the TEE enclave in each FL cycle, ensuring 56% and 8% less CPU and TEE memory overhead respectively when compared to DarkneTZ.

The paper is organized as follows. §2 defines the target problem. §3 presents a background about Federated Learning (FL), the considered state-of-the-art client-side privacy attacks, the basic architecture of ARM TrustZone, as well as DarkneTZ. In §4 we present our threat model. Then, we introduce the concepts of secure FL with an overview of GradSec in §5. We discuss the sources of gradient leakage underlying the design of GradSec in §6. The design of GradSec is detailed in §7. In §8 we evaluate GradSec using state-of-the art models and against state-of-the-art attacks. We survey related work in §9, before concluding in §10.

PROBLEM STATEMENT

Protecting FL systems against inference attacks is becoming an increasingly important problem. While server-side inference attacks have attracted a lot of attention in the research community [START_REF] Kallista | Practical Secure Aggregation for Federated Learning on User-Held Data[END_REF][START_REF] Fang | Privacy preserving machine learning with homomorphic encryption and federated learning[END_REF][START_REF] Wei | Federated learning with differential privacy: Algorithms and performance analysis[END_REF], mitigation mechanisms against client-side inference attacks have been overlooked. Specifically, to illustrate the harm a malicious client can perform, we considered three state-of-the-art inference attacks: (i) a Data Reconstruction Inference Attack (DRIA) [START_REF] Zhu | Deep Leakage from Gradients[END_REF], which aims a reconstructing a data sample (e.g., an image Table 1: Success rate of SOTA attacks against LeNet-5 model (line 1); Layers that need to be put in TEEs using both DarkneTZ and GradSec to protect the model against attacks launched by a malicious client (lines 2 and 3) and the corresponding gain of GradSec compared to DarkneTZ (lines 4 and 5). ≡ indicates similar performance.

that was used at training time); (ii) a Membership Inference Attack (MIA) [START_REF] Nasr | Comprehensive Privacy Analysis of Deep Passive and Active White-box Inference Attacks against Centralized and Federated Learning[END_REF], which aims at inferring whether a given data sample has been used (or not) at training time and (iii) a Data Property Inference Attack (DPIA) [START_REF] Melis | Exploiting Unintended Feature Leakage in Collaborative Learning[END_REF], which aims at inferring sensitive properties (e.g., gender) about the participating users. While these attacks were initially devised on the server side, we adapted them to run on a malicious client. Specifically, we ran the above attacks on clients participating in an FL training process for the LeNet-5 machine learning model [START_REF] Lecun | Gradient-based learning applied to document recognition[END_REF], an image classification model trained using the CIFAR-100 dataset. Further details on the experimental setup of this experiment as well as further details on the attacks can be found in §7.3 and §3.2, respectively. Results depicted in the first line of Table 1 show that a malicious client successfully manages to run the above attacks. An effective way to protect FL clients from the above attacks is to use TEEs on the client side, as previously demonstrated by DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF] a system further described in Section 3.4. From line 2 of Table 1, we see that DarkneTZ successfully protects against DRIA and MIA as putting only one layer inside the TEE makes the attack unsuccessful. However, as soon as two attacks are considered at once (DRIA + MIA) or a more complex attack is considered (DPIA), DarkneTZ requires putting four out of the five layers of the model inside the TEE, which incurs an important overhead. In this paper, we propose a solution that allows protecting non-successive layers inside the TEE (static GradSec) as well as a solution for dynamically putting layers inside the TEE in a roundrobin (RR) manner (dynamic GradSec). As shown in the two last lines of Table 1, our solution brings an important performance improvement over DarkneTZ, i.e., up to 30% gain in terms of TCB size and up to 56% gain in terms of model training time.

BACKGROUND

This section provides background on federated learning ( §3.1), client-side privacy attacks against which GradSec protects ( §3.2), more details regarding ARM TrustZone, the TEE we have chosen to prototype GradSec ( §3.3), and finally a description of DarkneTZ, the closest related work ( §3.4).

Federated Learning (FL)

Federated Learning, initially developed for word prediction on the Google's Gboard keyboard [START_REF] Yang | Applied Federated Learning: Improving Google Keyboard Query Suggestions[END_REF], is a distributed approach to machine learning that trains a model on decentralized data. Its principle is to transfer a learning model from a central server to client data (referred to as a "codeto-data" approach) rather than the other way around. Each client then trains the model locally (on its own device), hence the data never leaves its device. Gradients of the resulting model are then sent to a central server, which aggregates them with other clients' gradients. This design improves the clients' privacy, a key property feature clearly lacking in centralized machine learning. There exist several industrial applications using FL [START_REF] Dilmegani | What is Federated Learning (FL)? Techniques & Benefits in[END_REF][START_REF] Li | A review of applications in federated learning[END_REF]. Google uses FL on its mobile apps to improve on-device machine learning models, e.g., "Hey Google" in Google Assistant to let users issue voice commands [START_REF] Yang | Applied Federated Learning: Improving Google Keyboard Query Suggestions[END_REF]. On healthcare domain, FL is claimed to be the turn-key solution for making the transition from research to clinical practice by enabling the privacy-preserving learning from confidential medical analysis [START_REF] Rieke | The future of digital health with federated learning[END_REF]. In manufacturing industries, FL enable multiple companies to train a condition-monitoring system, that monitors a particular condition in machinery (such as vibration, temperature, etc.) to identify changes that could indicate a developing fault, without revealing their respective data and assets [START_REF] Kanagavelu | Federated Learning for Advanced Manufacturing Based on Industrial IoT Data Analytics[END_REF] and keep their IP confidential. However, despite this growing popularity [START_REF] Google | Why Is Federated Learning Getting So Popular[END_REF], FL already has been challenged by several privacy attacks, in particular because the shared models can be reverse engineered to identify clients data, or at least some of its features.

Client-Side Privacy Attacks in FL

Privacy attacks threaten the confidentiality of FL systems in particular for edge devices. Solutions exist to restrict gradients model access on the FL server (secure aggregation [START_REF] Kallista | Practical Secure Aggregation for Federated Learning on User-Held Data[END_REF], Differential-privacy [START_REF] Dwork | Differential Privacy: A Survey of Results[END_REF][START_REF] Wei | Federated learning with differential privacy: Algorithms and performance analysis[END_REF], homomorphic encryption [START_REF] Fang | Privacy preserving machine learning with homomorphic encryption and federated learning[END_REF], etc.), preventing the leak of gradients. However, the clientside OS, system libraries and the device itself may also be compromised by memory scraper malwares [START_REF] Rodríguez | Evolution and characterization of pointof-sale RAM scraping malware[END_REF] that scan the RAM of infected devices, leading to leakage of the gradients as well as full disclosure of client data. Next, we detail how three state-of-the-art privacy attacks operate.

Data-Reconstruction Inference Attack (DRIA). This attack [START_REF] Zhu | Deep Leakage from Gradients[END_REF] aims at reconstructing an original input data based on the emitted model gradients. This attack assumes a honest-but-curious attacker running in an FL client device, monitoring the FL training process, particularly the gradients produced, before they are sent to the server. The attacker specifically searches for two emitted gradients, produced right after input and those produced due to attacker's random input, respectively. Then, through an optimisation algorithm (Adam [START_REF] Diederik | Adam: A method for stochastic optimization[END_REF], LBFGS [START_REF] Dong | On the limited memory BFGS method for large scale optimization[END_REF], etc.) similar to Gradient Descent, the attacker optimizes (minimizes) the difference between the two gradients which mathematically leads to generate a random data that approximate the targeted input data.

Membership Inference Attack (MIA) [START_REF] Nasr | Comprehensive Privacy Analysis of Deep Passive and Active White-box Inference Attacks against Centralized and Federated Learning[END_REF] learns whether specific data instances are present in the global model training dataset (𝐷). The attacker is a malicious FL client with prior knowledge about 𝐷, i.e., it knows some data that are part of 𝐷 (𝐷 1 ⊂ 𝐷) and some which aren't (𝐷 2 ⊄ 𝐷). The attacker builds a binary classifier by training an attack model on the FL model' gradients wrt. 𝐷 1 and 𝐷 2 . To infer the membership probability of a data point, the attacker feeds it to the FL model, and computes its corresponding gradients. The generated gradients will be used as input data to the attack model. The latter will output the membership probability of the gradients corresponding to the former data point.

Data-property Inference Attack (DPIA). The third attack is DPIA [START_REF] Melis | Exploiting Unintended Feature Leakage in Collaborative Learning[END_REF]. It infers the probability of presence of a private property (prop) seen by the FL model during his local training by one of the FL clients. Like MIA, it assumes a malicious FL client who trains a binary classifier (attack model) on model gradients (𝑔 𝑝𝑟𝑜𝑝 , 𝑔 𝑛𝑜𝑛𝑝𝑟𝑜𝑝 ) against attacker's auxiliary data (𝑏 𝑎𝑑𝑣 𝑝𝑟𝑜𝑝 , 𝑏 𝑎𝑑𝑣 𝑛𝑜𝑛𝑝𝑟𝑜𝑝 ). The gradients are computed using different snapshots of the FL model, taken across several FL cycles. To infer the probability of presence of prop among batches of data used to train the global model during an FL cycle, the attacker computes the difference between two consecutive snapshots of the global model to get the aggregated gradients, and feeds those to the attack model.

ARM TrustZone

TrustZone [START_REF] Amacher | On the Performance of ARM TrustZone -(Practical Experience Report)[END_REF][START_REF] Pinto | Demystifying arm trustzone: A comprehensive survey[END_REF] is the TEE for ARM processors. It effectively provides hardware-isolated areas of the processor for sensitive data and code. TrustZone splits the execution in two modes (see Figure 1): (1) Rich Execution Environment (REE) for normal untrusted OS and (2) Trusted Execution Environment (TEE) for secure OS. The REE is fully managed by the regular OS which executes legacy applications without security guarantees. The memory, registers and caches of the REE are not protected by any hardware mechanism. In contrast, the TEE is managed by the secure OS, which executes trusted applications (TAs) with additional confidentiality and integrity guarantees. TAs rely on services, provided by the TEE kernel, to securely access resources (disk, TCP/IP stack, memory...). In turn, TAs provide API services for legacy applications as well as other TAs. There exist several available implementations for trusted OS with full support for Trust-Zone. Examples include (i) OP-TEE (Open Portable TEE) [START_REF] Trustedfirmware | OP-TEE Documentation[END_REF], the Linaro implementation of secure OS for TrustZone; (ii) Kinibi [START_REF]Kinibi-520a: The latest Trustonic Trusted Execution Environment (TEE)[END_REF], the TEE OS of Trustonic that uses a microkernel design to enforce isolations between worlds and (iii) Trusty [START_REF]Trusty TEE[END_REF], the secure OS implementation of Android that is meant to offer a standard for developping trusted apps for all android devices. The main limit of TrustZone is its limited footprint size, inlcuding secure memory size (up to 3-5MB), due to its high cost. Such limitation may prevent users from protecting all the layers of a deep neural network (DNN) inside the enclave, requiring to carefully select which layers we need to secure against a specific attack.

DarkneTZ

DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF] is an open-source DNN framework compatible with TrustZone and the OP-TEE secure OS [START_REF] Trustedfirmware | OP-TEE Documentation[END_REF]. It builds upon Darknet [START_REF] Redmon | Darknet: Open Source Neural Networks in C[END_REF], an open-source neural network framework implemented in C and with support for CUDA. Dark-neTZ allows users to secure only successive layers of a neural network in a TrustZone TEE enclave. Similar to GradSec, it attempts to circumvent the concern of the limited memory size of the TEE enclave by asking the user the ability to protect only a portion of contiguous layers of models. This solution has proven to be effective in countering MIA by protecting only some of the last layers of the model and also DRIA by protecting some of the first layers. However, we show in this paper that DarkneTZ is not effective to protect against both attacks simultaneously since, to do so, non successive layers of a machine leaning model need to be protected into the TEE (e.g., the first layers and the last layers), which is not enabled by the framework as stated in the paper [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF]. Hence, to protect against the above attacks simultaneously, DarkneTZ requires to secure almost all layers of the underlying model, which generates an important overhead. Moreover, DarkneTZ has not been proved to be effective against DPIA, which we also demonstrate in our evaluation section.

THREAT MODEL

We assume an honest-but-curious client-side attacker. The attacker does not tamper with the FL process and message flow, and it does not attempt to modify the normal message exchanges of the protocol. Instead, we assume it has physical access to the client machine, where he can execute processes with high/root privileges. We further assume that the server side of the FL process is secured using server-grade TEEs (such as Intel SGX) [START_REF] Zhao | SEAR: Secure and Efficient Aggregation for Byzantine-Robust Federated Learning[END_REF], with fewer memory restrictions, or by leveraging secure aggregation protocols [START_REF] Bonawitz | Practical Secure Aggregation for Privacy-Preserving Machine Learning[END_REF] through multi-party computation.

Similar to DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF], we assume feed-forward neural networks [START_REF] Fine | Feedforward neural network methodology[END_REF], such as fully-connected or convolutional neural networks (CNN) [START_REF] Saad Albawi | Understanding of a convolutional neural network[END_REF], also considered by the privacy attacks described in Section 3.2.

SECURE FEDERATED LEARNING

Figure 2 presents an overview of our approach. We consider a set of clients taking part in the FL training process of a given machine learning model. GradSec's typical workflow runs as follows. Selection of FL clients. To ensure that our approach of securing the local training is effective, the FL server only samples clients with a TEE-compatible device, discarding those without a TEE (Figure 2-➊). Therefore, a client interrogation step is required before selecting them for an FL cycle. The FL server can ensure the trustworthiness of the FL client code leveraging novel remote attestation support, for instance as provided by [START_REF] Ménétrey | WaTZ: A Trusted WebAssembly Runtime Environment with Remote Attestation for TrustZone[END_REF]. 2-➋). When receiving the FL model, some of its layers should be protected while the others can be left outside the TEE. GradSec puts the protected layers' weights into the TEE enclave directly using the trusted I/O path (TIOP), as described further in §7.3).

Secure local training.

Each FL client trains his model locally with his own data (see Figure 2-➌). We developed two ways to secure the training. In the first one, i.e., Static Grad-Sec, some layers of the model are permanently protected (e.g., from the first FL cycle until the last) against gradient leakage while the others are not. This approach is effective against some state-of-the-art attacks as further discussed in §7.3. In the second approach, Dynamic GradSec, the protected layers change along with FL cycles. This approach is necessary to protect against more complex attacks as discussed in §7.3. In both cases, the data used for training is kept in the storage of the FL client using TrustZone's secure storage [START_REF] Benedito | KeVlar-Tz: A Secure Cache for ArmTrustZone -(Practical Experience Report)[END_REF][START_REF] Daniel | Secure Block Device -Secure, Flexible, and Efficient Data Storage for ARM TrustZone Systems[END_REF] to prevent an external entity from performing a direct leakage of data. This step implements the main contribution of GradSec, with a solution that guarantees a secure local training for the FL clients.

Transmission of the model updates. Finally, at the end of each FL training cycle, the model gradients of each client are sent to the FL server to be aggregated (Figure 2-➍).

SOURCES OF GRADIENTS LEAKAGE

This section presents the major sources of gradients leakage potentially arising when training a model in a FL context. GradSec is designed in a way to circumvent these flaws. Table 2 summarizes the notations of data and operations related to the FL model training. We use the popular Loss function for multi-class classifiers, i.e., the Categorical Cross-Entropy [START_REF] Peltarion | Categorical crossentropy[END_REF].

In the following, we explain how the gradients of a neural network might leak, a required step to propose the countermeasures contributed by GradSec. Specifically, we identify two major flaws.

1 𝑠𝑡 𝐹𝑙𝑎𝑤 : Computing the difference between consecutive states of a model. Once the FL client receives the global model from the FL server, it trains it locally with its private data over some local iterations (epochs) and updates the weights of each layer l, following the gradient descent formula (SGD) :

𝑊 𝑡 +1 𝑙 = 𝑊 𝑡 𝑙 -𝜆𝑑𝑊 𝑙 with 𝑡 the current epoch (1)
With access to the weights of layer l, an attacker can exploit the following simple formula to infer its gradients.

𝑑𝑊 𝑙 = 𝑊 𝑡 +1 𝑙 -𝑊 𝑡 𝑙 𝜆 (2)
Exploiting formula (2) is our 1 𝑠𝑡 𝐹𝑙𝑎𝑤.

2 𝑛𝑑 𝐹𝑙𝑎𝑤 : Tracking the back propagation computation flow. The injection of a batch of data X into the model initiates two sequential computations: (i) forward propagation and (ii) backward (back) propagation. The computation of the gradients naturally takes place during the back propagation. It consists in a sequence of operations, involving the weights of each layer, that starts from the last layer and propagates backward until the first, in order to compute layer gradients in a descending fashion. The formulas for calculating the gradients of a layer l during back propagation are, for each type of layer as follows:

For a dense layer :

𝑑𝑊 𝑙 = 𝛿 𝑙 .𝐴 𝑙-1 = 1 𝑚 ( Ŷ -𝑌 ).𝐴 𝑛-1 if 𝑙 = 𝑛 ((𝑊 𝑙+1 .𝛿 𝑙+1 ) * 𝑓 ′ 𝑙 (𝑍 𝑙 )).𝐴 𝑙-1 if 𝑙 < 𝑛 (3
) For a convolutional layer :

𝑑𝑊 𝑙 = 𝛿 𝑙 ⊗ 𝐴 𝑙-1 = ((𝑊 𝑙+1 ⊗ 𝛿 𝑙+1 ) * 𝑓 ′ 𝑙 (𝑍 𝑙 )) ⊗ 𝐴 𝑙-1 if𝑙 < 𝑛 (
4) For this layer, the l=n case is removed because a convolutional layer cannot be at the end of a classifier.

Exploiting formulas [START_REF]Trusty TEE[END_REF]

GRADSEC

We present here GradSec, a gradient leakage protection which circumvents the previous flaws by exploiting TEEs. To prevent the attacker from leaking the gradients of layer l by any of the previous mathematical formulas, GradSec secures in the enclave 𝑊 𝑙 , 𝑍 𝑙 , 𝐴 𝑙-1 and 𝛿 𝑙 as well as the operations in which they are involved. Figure 3 shows the general architecture of an arbitrary protected layer 𝑙 2 in a 5-layer neural network. GradSec works in two modes: static ( §7.1) and dynamic ( §7.2).

Static GradSec

In static mode, the FL server fixes in advance a subset of the model layers to be protected in the client-TEE enclave during all the FL cycles. This mode is useful when one knows in advance which layers are sensitive to some attacks (e.g., the early/convolutional layers exploited in the DRIA attack, the tail/dense layers exploited by the MIA attack, etc.). static GradSec is similar to DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF] in its approach to fix, in advance, protected layers. Yet, GradSec has the ability to protect non-successive layers inside the TEE enclave, a subtle yet key difference against DarkneTZ. The latter feature is interesting to secure two distant layers of a neural network. For instance, one could protect layers from the convolutional part that extract meaningful characteristics from the data, and layers from the fully-connected part that usually classifies them. This option is fundamental to simultaneously protect against DRIA and MIA attacks, while avoiding to secure the intermediate layers and hence reduces the overall TCB size, without penalizing security. The only parameter required to use static GradSec is the list of layers to protect.

Dynamic GradSec

With this mode, the layers protected by the TEE, at each client level, change through a moving window (MW ) over FL cycles. The parameters configuring this approach are fixed by the FL server. These are:

(1) 𝑠𝑖𝑧𝑒 𝑀𝑊 : the number of successive layers to be put in the TEE enclave in each cycle (fixed number for all cycles). (2) 𝑉 𝑀𝑊 : the probability distribution vector of the MW location. It expresses the probability that a given set of successive layers remain on TEE for each FL cycle before MW moves. As an example, Figure 4 The main intuition behind dynamic GradSec is to try to protect all the layers of a DNN without putting them all at once inside the TEE, due to its limited size. Thus, the MW acts as a sliding TEE region that can only host limited subset of the layers at once. Further, since each group of layers covered by the MW may have different sensitivity toward an attack, we offer the ability to customize the protection probability for each group through 𝑉 𝑀𝑊 . As shown later in our evaluation ( §8), such strategy is more effective than statically protecting layers against DPIA, where the sensitivity toward the attack is unequally distributed among all the layers.

End-to-end security solutions

Trusted I/O path. To safely interact with the device's peripherals, TrustZone enables the reflection of the world state of the processor into the peripherals [START_REF] Pinto | Demystifying arm trustzone: A comprehensive survey[END_REF]. Specifically, the client network interface could receive the model weights, related to the protected layers, from the FL server, and safely transfer them in the TEE secure memory throughout a secure channel. Secure Storage. TrustZone's secure storage [START_REF]Secure storage[END_REF] enables storing general-purpose data and key material while guaranteeing confidentiality and integrity of the latter and the atomicity of the operations that modify them. It leverages a randomly generated File Encryption Key (FEK) for encrypting and decrypting the data stored in block file. The FEK itself is encrypted/decrypted by the Trusted Application Storage Key (TSK) which is derived from the per-device Secure Storage Key (SSK) and the TA's identifier (UUID). GradSec could leverage such functionality to guarantee the confidentiality [START_REF] Ménétrey | WaTZ: A Trusted WebAssembly Runtime Environment with Remote Attestation for TrustZone[END_REF] or by the incorporation of a hardware chip (e.g., Trusted Platform Module) that contains trusted code for measuring the integrity of the TEE kernel and cryptographic keys [START_REF] Zhao | Providing Root of Trust for ARM TrustZone Using On-Chip SRAM[END_REF].

EVALUATION

This section presents the experimental evaluation of our GradSec prototype. We consider two distinct ML models and real-world datasets. To evaluate the performance of GradSec, we choose the models and the datasets where each attack performs the best so as to measure the real efficiency of GradSec. We launched DRIA and MIA against the LeNet-5 [START_REF] Lecun | Gradient-based learning applied to document recognition[END_REF] (4 convolutional layers and 1 dense layer) and AlexNet [START_REF] Krizhevsky | Ima-geNet Classification with Deep Convolutional Neural Networks[END_REF] (5 convolutional layers and 3 dense layers) models using CIFAR-100 [START_REF] Krizhevsky | Learning multiple layers of features from tiny images[END_REF]. We rely on LeNet-5 [START_REF] Lecun | Gradient-based learning applied to document recognition[END_REF] using the LFW dataset [START_REF] Gary | Labeled Faces in the Wild: A Database for Studying Face Recognition in Unconstrained Environments[END_REF] to launch DPIA. Our threat model consider DRIA and MIA as single-shot attacks, i.e., they can be performed by an attacker in one FL cycle. Instead, DPIA is a long-term attack, as it needs several FL cycles to collect as many gradients as possible during the model evolution.

We deploy Dynamic GradSec against DPIA, to observe the impact in changing the protected layers along the FL cycles. Table 3 recaps these configurations. Table 4 details the architecture of each model.

Evaluation settings

We rely on an existing Python implementation of DRIA [START_REF] Han | Deep Leakage From Gradients implementation[END_REF], MIA [START_REF] Shokri | ML Privacy Meter. github[END_REF] and DPIA [START_REF] Song | Property Inference in Collaborative ML implementation[END_REF]. DRIA rely on the LBFGS [START_REF] Dong | On the limited memory BFGS method for large scale optimization[END_REF] optimization algorithm to perform the attack, while MIA and DPIA rely on a dataset of leaked gradients (𝐷 𝑔𝑟𝑎𝑑 ), built by the attacker. To mimic the layer-level gradient confidentiality offered by a TEE enclave, we simply delete from 𝐷 𝑔𝑟𝑎𝑑 all the gradients columns relative to a protected layer since the latter are considered as unavailable for an attacker located in the normal world. In practice, to dynamically change the protected layers at each FL cycles, we inject the required configuration in 𝐷 𝑔𝑟𝑎𝑑 only if the moving window MW should protect the concerned layer for the given FL cycle.

To measure the performance impact at deployment of GradSec, We implement and evaluate GradSec using Raspberry Pi 3B+, a popular yet representative single-board device, equipped with Broadcom BCM2837B0 (ARM Cortex A53 quad core @ 1.4GHz, 1GB LPDDR2) to mimic an FL client which trains a model. We use the latest stable release of OP-TEE [START_REF] Trustedfirmware | OP-TEE Documentation[END_REF], a secure OS with TrustZone support. We leveraged the latest stable release of DarkneTZ [START_REF] Mo | Dark-neTZ: Towards Model Privacy at the Edge Using Trusted Execution Environments[END_REF] as a privacy-preserving deep learning framework to build Grad-Sec. For static GradSec, we extended DarkneTZ to protect two slices of non-successive layers, in order to efficiently protect against DRIA and MIA simultaneously. For dynamic GradSec, we rely on the vanilla DarkneTZ implementation.

Security Analysis

We quantify the performance of DRIA using the Image Loss metric, i.e., the euclidean distance between the attacker's inferred image and the original FL client image fed to the model. We measure the performance of MIA and DPIA using AUC, i.e., an aggregated measure of the attack model performance considering all the possible classification thresholds. It is statistically consistent and more discriminating measure than accuracy [START_REF] Ling | AUC: a Statistically Consistent and more Discriminating Measure than Accuracy[END_REF]. An attack model with an AUC of 0.5 is considered as inefficient and performing a random guess regardless the classification threshold. DRIA. Securing the first layers (especially the 2𝑛𝑑 layer) with static GradSec is sufficient to make the attack fail in both our models. The attacker obtains a reconstructed yet blurry image with a large Image Loss (see Figure 5). Even if we were unable to reproduce a clear image with a non-protected AlexNet model, protecting layers inside a TEE enclave (in particular the second layer), still makes DRIA performs even worse. Indeed, for reconstructing visual data fed to a neural network, convolutional layers are the most suitable target for an attacker since they capture more of the visual features of data. Specifically, protecting the firsts convolutional layers (L1 + L2) have the highest impact against DRIA, since those are used to extract the low-level visual features (e.g., image edges). Instead, the tail layers extract high-level features (e.g., color of eyes, shape complexity, etc.). By preventing the attacker from getting the low-level features, that are the support for the high level ones, it fails at rebuilding the input features. Takeaway: to mitigate DRIA, one should focus on securing the first layers of the convolutional part of the models.

MIA. Securing the last layer (i.e., the 5𝑡ℎ layer) in LeNet-5 with static GradSec lowers the attack's AUC from 0.95 to 0.85. Protecting additional tail layers show little benefits, as the AUC attack only drop by 5% with last 4 layers protected (see Figure 6 (a). For AlexNet, the focus of an attacker should also be on the gradients of tail layers (L6, L7 and L8) that constitutes the dense part of the model, to succeed in MIA with an AUC of 0.79. Thus, protecting these specific layers is effective to lower the AUC until 0.59, assuming the attacker would exploit the gradients of the convolutional part of the model. To decrease the number of the protected layers, shielding layer L6 is sufficient to reduce the AUC to 0.56 if the attacker focuses on exploiting the two remaining dense layers. Figure 6 (b) summarizes these results.

Takeaway: to reduce MIA impact, securing layers of the Dense part usually found at the end of a model remains more efficient than securing the layers of the convolutional part.

DPIA. Protecting individual layers using static GradSec proves ineffective against this attacks. We systematically hit an AUC rate of 0.99 regardless the protected layer. While it is possible to lower the AUC down to 0.85 with 4 protected layers inside the enclave, this would consumes a large share of the available secure memory (1.841MB for LeNet-5, see Section 8.3), a scarce resource shared with other Secure Applications, and heavily impacts the training time (see 8.3). Instead, dynamic GradSec achieves a better AUC rate (0.78) with only two simultaneous layers inside the enclave (𝑠𝑖𝑧𝑒 𝑀𝑊 = 2) and with an appropriate choice of 𝑉 𝑀𝑊 ( [0.2, 0.1, 0.6, 0.1]). Table 5 resumes these results. To find the best distribution of 𝑉 𝑀𝑊 for each value of 𝑠𝑖𝑧𝑒 𝑀𝑊 , we train different instances of the attack model (random forest) on a gradient train set with differently located missing data to reflect changing protected layers across the FL cycles, according to the chosen 𝑉 𝑀𝑊 . The incomplete columns of the train set are filled with the mean strategy. We evaluate each attack model instance on a gradient validation set and we retain the 𝑉 𝑀𝑊 distribution of the worst instance. Finally, we test 𝑉 𝑀𝑊 on a gradient test set that reflects unseen gradients.

Overhead

We use two metrics to measure the performance impact of GradSec on the LeNet-5 model. Firstly, we consider the model training time of one FL cycle per configuration of protected layer(s). We break down this in three parts: (1) computation in user-space, spent outside the TrustZone enclave, (2) kernel-space time, spent inside the enclave during the training process, and (3) allocation time, i.e., time to allocate the TEE memory for the received weights, before starting the training process. We rely on the real-time dashboard provided by DarkneTZ to measure the user and kernel time. For the TEE memory allocation time, we instrumented the code with timers around the memory allocation for the model weights.

Secondly, we measure the maximum TEE memory usage for each configuration of protected layer(s). TrustZone doesn't provide a direct tool to measure the used TEE memory size and doing so from the normal world is prohibited due to the restriction imposed by the secure world. To address this issue, we locate all the DarkneTZ code parts where the TEE memory allocation is triggered through the malloc / calloc instructions and summed the sizes of allocated regions. In the case of dynamic GradSec, we computed the previous metrics for each 𝑠𝑖𝑧𝑒 𝑀𝑊 and using the best 𝑉 𝑀𝑊 distribution (i.e., the one achieving the highest security). Since the protected layers change over the FL cycles, we use a weighted average over all the different protection positions covered by the MW to compute the training time. For the TEE memory usage, we just included the consumption of the most expensive combination among the different possibilities allowed 6: CPU Time and TEE memory usage of GradSec (LeNet-5, CIFAR-100, batch-size = 32) by the MW. The results are summarized in the Table 6 and Figure 7, and discussed in the remainder of this section.

DRIA. To protect LeNet-5 against DRIA, static GradSec should focus on securing the layer L2. Weobserve a 20% increase in the training time when compared to training the model outside the enclave, while the required TEE memory size is about 0.57MB.

MIA. To protect LeNet-5 against MIA, static GradSec should focus on securing the last layer (L5). By doing so, we measure an important increase in the training time (i.e., 212%) when compared to training the model outside the enclave, while the required TEE memory size is about 0.70MB. This significant overhead for the training time is mainly caused by the memory allocation for L5 which has a fairly large number of parameters (76.8K).

Grouped protection. Protecting LeNet-5 against DRIA and MIA simultaneously require to secure the sensitive layer of each attack with Static GradSec, i.e., L2 and L5. Unsurprisingly, the training time overhead increases by 235%, while the required TEE memory is 1.27MB, the fairly heavy L5 being responsible for the large majority of this overhead.

DPIA. To mitigate DPIA with dynamic GradSec, the best option in terms of security and overhead is to use 𝑠𝑖𝑧𝑒 𝑀𝑊 = 2 with 𝑉 𝑀𝑊 = [0.2, 0.1, 0.6, 0.1]. Indeed, as we have seen in section 8.2, this configuration offers better protection than Dark-neTZ while requiring only two simultaneously protected layers for each cycle, The overhead to mitigate DPIA is a 53% longer training time and 1.692 MB of TEE memory usage in the worst case (when the 𝑀𝑊 protects L1+L2).

Comparison with DarkneTZ. Finally, we compare Grad-Sec against DarkneTZ in terms of training time and TEE memory usage. The results are shown Figure 8. We use static GradSec to offer simultaneous protection against DRIA and MIA with the cost of 2 protected layers (L2 and L5). To offer a comparable level of protection with DarkneTZ, not only networks by leveraging quantization to reconcile privacy, accuracy and efficiency. The main objective of the Gecko design is to mitigate blackbox MIA. However, contrary to GradSec, no evidence is given regarding the resilience of the proposed solution against other attacks we dealt with (e.g., DRIA, DPIA). BatchCrypt [START_REF] Zhang | BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning[END_REF] is an Homomorphic Encryption (HE) method for Cross-Silo FL. It aims at reducing the cost in computation and communication of HE when the gradients are homorphically encrypted. Instead of encrypting individual gradients with full precision, BatchCrypt encodes a batch of quantized gradients into a long integer and encrypt it in one go. To allow aggregation of gradients to be performed on ciphertexts of the encoded batches, authors in [START_REF] Zhang | BatchCrypt: Efficient Homomorphic Encryption for Cross-Silo Federated Learning[END_REF] propose new quantization and encoding schemes, alongside a new gradient clipping technique. BatchCrypt considerably improves over vanilla HE method and is well suited to ML constraints. However, it lacks support for an end-to-end solution to circumvent the problem of comprised clients whose OS may leak the gradients before being encrypted, in contrast with TEE solutions like GradSec. Slalom [START_REF] Tramèr | Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware[END_REF] presents a system and solution for high performance execution of Deep Neural Networks (DNNs) in TEEs. In a nutshell, it efficiently partitions DNN computations between trusted and untrusted devices. It leverages both GPU (for efficient batch computation) and a TEE (for minimizing the use of cryptography). Specifically, Slalom is a framework that delegates execution of all dense layers in a DNN from a TEE to a faster, yet untrusted, processor (i.e., typically, a GPU). It requires a lot of pre-computation over known and fixed weights, and hence it only supports private inference and not training. In addition, dense layers may also leak sensitive information, useful for MIA, especially if the computation in which they are involved are computed outside the TEE enclave. Citadel [START_REF] Zhang | Citadel: Protecting Data Privacy and Model Confidentiality for Collaborative Learning[END_REF] is a federated learning framework, built on top of Intel SGX enclaves. It relies on two distinguished set of worker enclaves (training and aggregator ones). It employs zero-sum masking and hierarchical aggregation techniques to prevent gradient leaking across such worker enclaves. However, it does not protect against membershipinference attacks, and it is strongly coupled to Intel SGX enclaves. Given the future roadmap of Intel toward serveronly deployments of SGX, we believe GradSec to be better suited to be deployed on edge devices in a federated learning system.

CONCLUSION AND FUTURE WORK

We presented GradSec, a TEE-based protection mechanism that improves FL privacy guarantees against state-of-theart inference attacks. GradSec can operate in two modes: static and dynamic. Static GradSec can simultaneously protect against DRIA and MIA attacks with less overhead than DarkneTZ. Dynamic GradSec offers a better protection than DarkneTZ against DPIA while still incurring less overhead. We implemented GradSec on top of the OP-TEE trusted OS, and evaluated its performance on a ARM Cortex-A53 processor with support for TrustZone enclaves. We plan to release GradSec to the research and open-source community.

We intend to extend this work along the following directions. First, we aim at adding support for RNNs (Recurrent neural networks). This would allow us to protect other types of machine learning models (e.g., models dealing with text, voice recordings and time series in general), and validate our approach on highly-sensitive domains (e.g., e-health). Second, we intend to study hybrid deployments, in which TEE-enabled clients are deployed alongside legacy clients without support for TEEs, and for which purely softwarebased approaches are necessary.

Figure 1 :

 1 Figure 1: Architecture of REE and TEE using ARM TrustZone. The secure monitor (SMC) allows to switch from the untrusted to the trusted world.)

Figure 2 :

 2 Figure 2: Overview of our approach on secure FL.

Figure 3 :

 3 Figure 3: General architecture of 𝑙 2 and 𝑙 3 protected layers

Figure 4 :

 4 Figure 4: Possible locations of the moving window (MW) in a 5-layers neural network.

Figure 5 :

 5 Figure 5: ImageLoss infered images with various protected layers using Static GradSec.

  AUC of MIA in LeNet-5 with various protected layers using Static GradSec. AUC of MIA in AlexNet with various protected layers using Static GradSec.

Figure 6 :

 6 Figure 6: AUC of MIA with various protected layers using Static GradSec.

Table 2 :

 2 Output Matrix of layer 𝑙 (𝑍 𝑙 = 𝑊 𝑙 .𝐴 𝑙-1 ) 𝐴 𝑙 Input Matrix of layer 𝑙 + 1 (𝐴 0 = 𝑋, 𝐴 𝑙 = 𝑓 𝑙 (𝑍 𝑙 ), 𝐴 𝑛 = Ŷ ) 𝑑𝑊 𝑙 Matrix of Gradients w.r.t 𝑊 𝑙 (𝑑𝐿𝑜𝑠𝑠/𝑑𝑊 𝑙 ) 𝛿 𝑙 Derivative of the 𝐿𝑜𝑠𝑠 function wrt 𝑍 𝑙 (𝑑𝐿𝑜𝑠𝑠/𝑑𝑍 𝑙 ) Notation and terminology related to FL model.

	Model Data
	Model-specific
	Notation	Designation
	𝑛	Number of layers of the model
	𝑋	Training Batch
	𝑌	Matrix of one-hot encoded labels
	Ŷ	Matrix of model predictions
	𝑚	Batch-size
	𝜆	Learning rate
	𝐿𝑜𝑠𝑠	Function of model accuracy to optimize
	Specific to layer l
	Notation	Designation
	𝑛 𝑙	Number of neurons (if 𝑙 is Fully-connected)
	𝐾 𝑙	Kernel size (if 𝑙 is convolutional)
	𝑊 𝑙	Matrix of weights (from the kernel if 𝑙 is convolutional)
	𝑓 𝑙	Activation function
	𝑍 𝑙
	Operations
	.	Ordinary product
	*	Hadamard product
	⊗	Convolutional product

Transmission of the FL model, hyper parameters and training plan. Clients receive the FL model, the hyperparameters and the training plan (Figure

  and (4) constitutes our 2 𝑛𝑑 𝐹𝑙𝑎𝑤 =l i out A i =l i+1 in f i =l i activation func. δ i =error from l i+1 to l i

		Z i
			forward	back-prop.	in TEE	W i =l i params
			δ 2		δ 2			Loss
	l 1	W 2	Z 2 A 2	W 3	Z 3 A 3	l 4	l 5	Prediction
			f 2		f 3
			layer 2		layer 3

  shows four possible locations for an MW of size 2 in a 5-layer neural network. If 𝑉 𝑀𝑊 = [0.1, 0.3, 0.4, 0.2] then the 𝑀𝑊 will spend 10% of the FL cycles protecting (𝑙 1 , 𝑙 2 ), 30% of the FL cycles protecting (𝑙 2 , 𝑙 3 ), 40% of the FL cycles protecting (𝑙 3 , 𝑙 4 ) and 20% of the FL cycles protecting (𝑙 4 , 𝑙 5 ). The number of possible locations for an MW (size of 𝑉

𝑀𝑊 ) in a neural network with 𝑛 layers is: 𝑛 -𝑠𝑖𝑧𝑒 𝑀𝑊 + 1.

Table 3 :

 3 Models, datasets and protection method per attack. and integrity of the received FL model, as well as the client data on its device persistent storage, outside of the training time (likely between FL cycles). Specifically, in the case of the GradSec prototype built on top of the OP-TEE trusted OS, two existing implementations for secure storage[START_REF]Secure storage[END_REF] exist, namely REE File System or RPMB File System, depending on the underlying hardware support of the client device. Remote attestation. Remote attestation (RA) allows remote parties to check the integrity and authenticity of the TEE environment[START_REF] Kari Kostiainen | Practical Property-Based Attestation on Mobile Devices[END_REF]. It constitutes a fundamental building block for establishing trust between a TEE and a remote party. RA allows the FL server to ensure that the client code is correctly executed in the TEE enclave. Despite the lack of native support for RA for TrustZone enclaves, support can be provided by leveraging novel solutions

	Attacks	Models	Datasets	Protection method
	DRIA	LeNet-5	CIFAR-100	Static GradSec
	MIA	AlexNet	CIFAR-100	Static GradSec
	DPIA	LeNet-5	LFW	Dynamic GradSec

Table 4 :

 4

			LeNet-5
	Layer Type	#Filters FS/S/P in. size out. size
	L1	Conv2D	12	5*5/2/0 32*32*3 16*16*12
	L2	Conv2D	12	5*5/2/2 16*16*12	8*8*12
	L3	Conv2D	12	5*5/1/2	8*8*12	8*8*12
	L4	Conv2D	12	5*5/1/2	8*8*12	8*8*12
	L5	Dense	/	/	768	100
			AlexNet
	Layer Type	#Filters FS/S/P in. size out. size
	L1	Conv2D +MP2 64	3*3/2/1 32*32*3	8*8*64
	L2	Conv2D +MP2 192	3*3/1/1	8*8*64 4*4*192
	L3	Conv2D	384	3*3/1/1 4*4*192 4*4*384
	L4	Conv2D	256	3*3/1/1 4*4*384 4*4*256
	L5	Conv2D +MP2 256	3*3/1/1 4*4*256 2*2*256
	L6	Dense	/	/	1024	4096
	L7	Dense	/	/	4096	4096
	L8	Dense	/	/	4096	100

Architecture of LeNet-5 and AlexNet. Conv2D: Convolutional layer; MP2: 2*2 MaxPool layer. FS/S/P: filter size/strides, pad.

Table 5 :

 5 AUC of DPIA using GradSec

		Static GradSec
	None L4 L3+L4 L3+L4+L5 L2+L3+L4+L5
	AUC 0.99	0.99 0.99	0.95	0.85
		Dynamic GradSec
	None	MW=2	MW=3	MW=4
	AUC 0.99	0.78	0.77	0.80

ACKNOWLEDGMENTS

This publication incorporates results from the VEDLIoT project, which received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 957197.

L2

RELATED WORK

We survey related work in the area of secure, confidential or privacy-preserving federated learning systems. PPFL. Fan Mo's PPFL (Privacy-preserving Federated Learning) [START_REF] Mo | PPFL: Enhancing Privacy in Federated Learning with Confidential Computing[END_REF]