---
title: 'Hybrid FL: Integrating HE and DP'
url: https://www.emergentmind.com/topics/he-and-dp-hybrid-federated-learning
type: topic
---

# Hybrid FL: Integrating HE and DP

Homomorphic Encryption (HE) and Differential Privacy (DP) hybrid federated learning—HE and DP–Hybrid FL—refers to a class of federated learning protocols that combine homomorphic encryption and differential privacy mechanisms within a unified workflow to balance privacy guarantees, model utility, and computational/communication efficiency. These frameworks aim to address the respective trade-offs of HE (high utility, high computation/communication overhead) and DP (lower overhead, but utility loss due to noise), and flexibly allocate or interleave the protections at the client, parameter, or round level. Recent advances manifest in multi-modal, adaptive, or interleaved designs, as well as in specialized vertical and horizontal federated learning architectures.

## 1. System Architectures and Adversarial Models

HE–DP hybrid frameworks support various FL scenarios, including horizontal FL with decentralized non-IID data and vertical FL where multiple organizations hold feature-partitioned data. The principal actors are central servers (or aggregators), distributed clients (data owners), and sometimes dedicated decryption servers, as in two-server models [2508.04265].

- **Clients:** Each client $k$ holds private data $D_k$, never leaving the device or organization.
- **Server(s):** Aggregate updates, orchestrate training rounds, but may be honest-but-curious.
- **Key/Decryption Managers:** In some frameworks (e.g., SelectiveShield), a key-distribution server holds the secret key, preventing the aggregator from decrypting collected ciphertexts [2508.04265].

Adversarial models typically assume a semi-honest/threatening server seeking to reconstruct or infer user data from model updates, as well as potential eavesdroppers and (less frequently) non-colluding clients. Threats include membership and reconstruction attacks at both the communication and final model levels. In vertical FL, participant organizations are semi-honest and aim to protect both intermediate results (IR) and eventual model output from each other [2009.02763].

## 2. Core Methodological Elements

Hybrid HE–DP FL protocols operationalize one or more of the following strategies:

- **Client-side mode selection:** Each client may select either HE or DP mode per round based on computational resources ($\mathrm{comp}_k$) and privacy needs (e.g., DP budget $\epsilon_k$). Threshold-based policies determine when to use HE (encryption of gradients, no noise injection) versus DP (Gaussian mechanism with norm clipping on gradients and noise addition) [2511.06064].
- **Parameter sensitivity partitioning:** Frameworks such as SelectiveShield compute the Fisher Information per parameter and negotiate encrypted/DP/noised/personalized partitions among clients. Sensitive parameters are encrypted with CKKS, personalized parameters are retained locally, and the remainder are perturbed by adaptive DP [2508.04265].
- **Round-based interleaving:** Alternating rounds of HE-based and DP-based aggregation (or additional synthetic data rounds) are orchestrated, with the interleaving ratio $\rho$ governing the trade-off between privacy protection and resource consumption [2603.05158].

### Table 1. Protection Allocation Strategies

| Dimension              | Example Approach                                 | Reference          |
|------------------------|--------------------------------------------------|--------------------|
| Per-client             | Resource/requirement-based HE/DP selection       | [2511.06064]       |
| Per-parameter          | Fisher-based split: HE for sensitive, DP for rest| [2508.04265]       |
| Per-round              | Interleaving HE and DP rounds                    | [2603.05158]       |

## 3. HE and DP Mechanisms in Hybrid FL

**Homomorphic Encryption:** Both CKKS (approximate, supports real vectors) [2511.06064], [2508.04265], [2603.05158] and BFV (exact, additive-only) [2205.04330] schemes are used. HE clients encrypt gradients or selected sensitive parameters; the server sums ciphertexts homomorphically and then decrypts (either itself or via a decryption server).

- Encryption/Decryption overhead is $O(d \cdot \mathrm{EncCost})$ per vector of dimension $d$, with communication expansion typically $4\times$–$5\times$ over plaintext [2508.04265].
- Parameter packing (e.g., $10^6$ parameters → $0.16$ MB ciphertexts for $1\%$ of parameters) makes selective encryption practical at scale [2508.04265].

**Differential Privacy:** DP clients apply local or user-level DP via Gaussian mechanism:

- Gradients are clipped to a threshold $C$, and noise $z_k \sim \mathcal{N}(0, \sigma^2 I)$ is added, with $\sigma$ calibrated by privacy budgets $(\epsilon, \delta)$ [2511.06064].
- In parameter-partitioned or selective protection, only the non-encrypted/noised partitions receive DP perturbation [2508.04265].
- Advanced accounting (moments accountant, Rényi DP) is used for tight composition over multiple rounds [2205.04330], [2508.04265].

## 4. Protocol Workflow Variations

- **PPML-Hybrid** [2511.06064]: In each round, clients choose HE or DP. HE clients encrypt noise-free updates, DP clients clip and perturb gradients. Server aggregates HE gradients homomorphically and DP gradients in the clear; model is updated with combined sum.
- **SelectiveShield** [2508.04265]: Clients estimate per-parameter Fisher information, mask sensitive parameters for encryption, privately negotiate partitioning, and perform mixed encrypted/DP/noised/personalized update protocol. Server aggregates and forwards to decryption/key server for global model update and broadcast.
- **Alt-FL** [2603.05158]: Implements three methods—Privacy Interleaving (PI), Synthetic Interleaving with DP (SI/DP), and Synthetic Interleaving with HE (SI/HE). The protocol alternates rounds (or parameter subsets) under HE or DP, with interleaving ratios controlling privacy and performance.

## 5. Privacy and Utility Trade-offs

Hybrid schemes interpolating between HE-only and DP-only realize a tunable privacy–utility–efficiency balance:

- **Privacy:** DP clients/mechanisms guarantee $(\epsilon, \delta)$-DP at the record or user level; non-colluding HE clients guarantee cryptographic secrecy if no collusion between server and decryption parties occurs [2511.06064]. The overall system’s formal DP guarantee is governed by the weakest (most permissive) partition (typically DP) [2511.06064].
- **Utility:** Noise is injected only for DP-processed components or clients. Signal-to-noise ratio scales inversely with the number of DP clients or the proportion of noise-injected parameters ($N_{DP} \cdot \sigma^2$ per coordinate). Increasing the HE portion improves utility at the cost of increased computational and communication overhead [2511.06064], [2603.05158].
- **Efficiency:** DP-only is fastest and lowest in communication; HE-only maximizes confidentiality but is slowest (3–4× the cost per round) [2511.06064]. Selective encryption, mask-based parameter partitioning, or interleaving can substantially reduce overheads while preserving strong protection for the most sensitive data [2508.04265], [2603.05158].

### Table 2. Empirical Results (from [2511.06064], PPML-Hybrid, $N=10$)

| Method           | $\epsilon$ | $\alpha$(HE frac) | MSE (↓) | FL Time (s) (↓) |
|------------------|------------|------------------|---------|-----------------|
| HE-only          | $\infty$   | 1.0              | 0.085   | 120             |
| DP-only          | 4, $\delta$| 0.0              | 0.143   | 35              |
| PPML-Hybrid      | 4, $\delta$| 0.5              | 0.092   | 70              |
| PPML-Hybrid      | 8, $\delta$| 0.5              | 0.110   | 68              |

Similar trends are observed in SelectiveShield, where encrypting just $1\%$ of parameters incurs minimal overhead ($0.03$ s per round), and model accuracy for $\epsilon=1$ matches or exceeds full-DP methods [2508.04265]. Alt-FL shows PI and SI/HE maintain high accuracy (within $5$–$8\%$ of non-private), substantial privacy (ASR $<0.5\%$), and controllable communication ($120$ MB vs $20$ MB for DP-only) [2603.05158].

## 6. Application Domains and Empirical Validations

Hybrid HE–DP FL has been demonstrated in multiple application domains:

- **Biomedical omics and spatial transcriptomics:** PPML-Hybrid enables high-fidelity model training on sensitive, non-IID patient data, preserving privacy and matching HE-only accuracy at $2\times$–$3\times$ less compute [2511.06064].
- **Image classification and text (EMNIST, CIFAR-10, Fashion-MNIST):** Fully homomorphic protocols with DP and Poisson quantization yield (user-level) DP and moderate accuracy degradation (e.g., $84.6\%\to76.8\%$ at $\epsilon\approx5.3$) with an amortized $3.6\%$ HE overhead [2205.04330]. SelectiveShield outperforms both MaskCrypt and DP-FedAvg at tight privacy budgets [2508.04265].
- **Vertical FL for inter-institutional GLMs:** Hybrid DP–HE (HDP-VFL) provides $(\epsilon,\delta)$-DP for all internal exchanged results and joint DP for released model weights, with accuracy within $1$–$2\%$ of the ideal VFL and $2$–$3\times$ speedup over HE [2009.02763].

## 7. Strengths, Limitations, and Practical Considerations

**Strengths:**
- Flexibility to match privacy, utility, and efficiency requirements by configuring client policy, parameter partitioning, or scheduling [2511.06064], [2508.04265], [2603.05158].
- Empirical results confirm mild to negligible accuracy loss versus non-private or HE-only baselines, with significant reduction in time and bandwidth [2511.06064], [2009.02763].
- Multi-level privacy: HE protects confidentiality from server/eavesdropper, DP protects against both intermediate and model-level attacks, including from clients and white-box/black-box queries [2205.04330], [2009.02763].

**Limitations:**
- Mask-based and parameter-sensitivity approaches may expose coarse information about local data distribution or customization [2508.04265].
- Protocols with additional servers (e.g., two-server KDS/aggregation) introduce new trusted parties and potentially single points of failure [2508.04265].
- The aggregated privacy depends on the weakest link, i.e., the least private clients or parameters [2511.06064].
- Scalability of HE encryption may still present issues in extremely large models or client pools, though partitioning mitigates this [2508.04265], [2603.05158].

**Practical Guidelines:**
- For high privacy and accuracy needs, round-based interleaving or sensitivity-driven partitioning are preferred [2603.05158], [2508.04265].
- DP-only suffices for minimal communication/compute budgets at relaxed privacy requirements [2511.06064], [2603.05158].
- Parameter or resource thresholds and mask negotiation can be tuned to application and system constraints, or even adapted dynamically [2508.04265], [2511.06064].

## References

- "A Privacy-Preserving Federated Learning Method with Homomorphic Encryption in Omics Data" [2511.06064]
- "Protecting Data from all Parties: Combining FHE and DP in Federated Learning" [2205.04330]
- "Hybrid Differentially Private Federated Learning on Vertically Partitioned Data" [2009.02763]
- "SelectiveShield: Lightweight Hybrid Defense Against Gradient Leakage in Federated Learning" [2508.04265]
- "Balancing Privacy-Quality-Efficiency in Federated Learning through Round-Based Interleaving of Protection Techniques" [2603.05158]

Source: https://www.emergentmind.com/topics/he-and-dp-hybrid-federated-learning