# Over-the-Air Federated Learning with Privacy Protection via Correlated Additive Perturbations

arXiv: https://arxiv.org/abs/2210.02235 · HTML: https://mlsanity.com/paper/2210.02235/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 19 of its 29 references that are in the map.
- First posted on arXiv 5 Oct 2022.

## Builds on (most cited first, 19 of 19)

- [Federated Learning: Strategies for Improving Communication Efficiency](https://mlsanity.com/paper/1610.05492/) (2016)
- [Optimization Methods for Large-Scale Machine Learning](https://mlsanity.com/paper/1606.04838/) (2016)
- [Deep Leakage from Gradients](https://mlsanity.com/paper/1906.08935/) (2019)
- [Linear Convergence of Gradient and Proximal-Gradient Methods Under the Polyak-Lojasiewicz Condition](https://mlsanity.com/paper/1608.04636/) (2016)
- [Federated Learning with Differential Privacy: Algorithms and Performance Analysis](https://mlsanity.com/paper/1911.00222/) (2019)
- [FetchSGD: Communication-Efficient Federated Learning with Sketching](https://mlsanity.com/paper/2007.07682/) (2020)
- [cpSGD: Communication-efficient and differentially-private distributed SGD](https://mlsanity.com/paper/1805.10559/) (2018)
- [Towards an Intelligent Edge: Wireless Communication Meets Machine Learning](https://mlsanity.com/paper/1809.00343/) (2018)
- [Dropout Training as Adaptive Regularization](https://mlsanity.com/paper/1307.1493/) (2013)
- [Over-the-Air Federated Learning from Heterogeneous Data](https://mlsanity.com/paper/2009.12787/) (2020)
- [Privacy For Free: Wireless Federated Learning Via Uncoded Transmission With Adaptive Power Control](https://mlsanity.com/paper/2006.05459/) (2020)
- [Wireless Federated Learning with Local Differential Privacy](https://mlsanity.com/paper/2002.05151/) (2020)
- [Attack-Resistant Federated Learning with Residual-based Reweighting](https://mlsanity.com/paper/1912.11464/) (2019)
- [Federated Learning via Intelligent Reflecting Surface](https://mlsanity.com/paper/2011.05051/) (2020)
- [An Accuracy-Lossless Perturbation Method for Defending Privacy Attacks in Federated Learning](https://mlsanity.com/paper/2002.09843/) (2020)
- [Private Wireless Federated Learning with Anonymous Over-the-Air Computation](https://mlsanity.com/paper/2011.08579/) (2020)
- [Differentially Private Federated Learning via Reconfigurable Intelligent Surface](https://mlsanity.com/paper/2203.17028/) (2022)
- [Over-the-Air Computing for Wireless Data Aggregation in Massive IoT](https://mlsanity.com/paper/2009.02181/) (2020)
- [Privacy-preserving Average Consensus: Privacy Analysis and Optimal Algorithm Design](https://mlsanity.com/paper/1609.06368/) (2016)

## Built on by (most cited first, 5 of 5)

- [A Survey on Over-the-Air Computation](https://mlsanity.com/paper/2210.11350/) (2022)
- [Over-The-Air Federated Learning: Status Quo, Open Challenges, and Future Directions](https://mlsanity.com/paper/2307.00974/) (2023)
- [Secure Over-the-Air Computation using Zero-Forced Artificial Noise](https://mlsanity.com/paper/2212.04288/) (2022)
- [Providing Differential Privacy for Federated Learning Over Wireless: A Cross-layer Framework](https://mlsanity.com/paper/2412.04408/) (2024)
- [Coding-Enforced Resilient and Secure Aggregation for Hierarchical Federated Learning](https://mlsanity.com/paper/2601.17995/) (2026)

## Abstract (arXiv)

In this paper, we consider privacy aspects of wireless federated learning (FL) with Over-the-Air (OtA) transmission of gradient updates from multiple users/agents to an edge server. By exploiting the waveform superposition property of multiple access channels, OtA FL enables the users to transmit their updates simultaneously with linear processing techniques, which improves resource efficiency. However, this setting is vulnerable to privacy leakage since an adversary node can hear directly the uncoded message. Traditional perturbation-based methods provide privacy protection while sacrificing the training accuracy due to the reduced signal-to-noise ratio. In this work, we aim at minimizing privacy leakage to the adversary and the degradation of model accuracy at the edge server at the same time. More explicitly, spatially correlated perturbations are added to the gradient vectors at the users before transmission. Using the zero-sum property of the correlated perturbations, the side effect of the added perturbation on the aggregated gradients at the edge server can be minimized. In the meanwhile, the added perturbation will not be canceled out at the adversary, which prevents privacy leakage. Theoretical analysis of the perturbation covariance matrix, differential privacy, and model convergence is provided, based on which an optimization problem is formulated to jointly design the covariance matrix and the power scaling factor to balance between privacy protection and convergence performance. Simulation results validate the correlated perturbation approach can provide strong defense ability while guaranteeing high learning accuracy.