Federated Learning (FL) has gained significant attention for enabling collaborative model training while preserving data privacy. However, protecting the intellectual property (IP) of models in FL, particularly against model theft by malicious clients, remains a critical challenge. Existing works often employ watermarking techniques to embed watermarks into models for ownership verification, but most of them can only verify ownership after the model has been stolen and cannot proactively defend against malicious clients attempting to steal the model. To address this limitation, this paper proposes FedLock, a novel server-side watermarking mechanism designed to resist model theft and safeguard the IP of global models. Specifically, FedLock leverages Split Federated Learning (SFL) to partition the model, effectively preventing malicious clients from accessing the complete set of global model parameters. To enhance security, FedLock incorporates an autoencoder for label encoding, safeguarding the server-side model from reconstruction attacks. Furthermore, FedLock introduces an additional backdoor client to embed a black-box watermark into the global model, enabling remote verification of model ownership. Experimental results demonstrate that FedLock achieves robust watermarking with minimal impact on model performance, effectively resisting various attacks, including model theft, pruning, and fine-tuning.

Incentive mechanisms are essential for boosting client engagement in differential private federated learning (DP-FL). However, existing Stakelberg games-based incentive mechanisms typically assume that client decisions are one-dimension and that data is independent and identically distributed (IID) across clients. In reality, data distributions are often non-IID and clients have two-dimensional resources decisions, including data quantity and privacy. Therefore, in this paper, we present a novel two-dimensional Stackelberg game-based incentive mechanism for DP-FL with non-IID data, aiming to maximize the total utility of clients and server by seeking a balance between the clients' two-dimensional decisions and the server's payment. Specifically, we first formulate the utility functions of both server and clients under two-dimensional decisions and then model the interactions between server and clients as a single-leader-multiple-followers Stackelberg game. To derive the optimal decisions that maximize their utilities, we theoretically prove the existence of a Stackelberg equilibrium between server and clients. Due to the difficulty to directly calculate the Stackelberg equilibrium, we propose a bi-level multi-agent reinforment learning algorithm to learn the optimal decisions for both server and clients by trial and error. Extensive simulation results demonstrate that our proposed method outperforms the baselines in terms of total utility.

Privacy protection and incentive mechanism are two fundamental problems in federated learning (FL), which aim at protecting the privacy of data owners and stimulating them to share more resources, respectively. Recent works have proposed differential privacy (DP) based privacy-preserving incentive mechanisms to solve both problems simultaneously. However, almost all of them took the privacy level as the only incentive item, without considering other factors, such as data quantity and quality. Moreover, an untrusted server can further infer sensitive information from the bids that reflect the true costs of data owners. To solve these problems, in this paper, we propose a dual-privacy preserving and quality-aware incentive mechanism, PrivAim, for federated learning. Specifically, it utilizes differential privacy to protect the local models and true costs against the untrusted parameter server, and carefully designs a multi-dimensional reverse auction mechanism to incentivize data owners with high quality and low cost to participate in FL without knowing the true bids. We theoretically prove that PrivAim satisfies$\Delta b$-truthfulness, individual rational, computational efficiency, and differential privacy. Extensive experiments show that PrivAim can effectively protect bid privacy, and achieve at least 21% and 6% improvement on social welfare and model accuracy, respectively, compared to the state-of-the-art.

Differential privacy (DP) has gained popularity in truth discovery recently due to its strong privacy guarantee. However, existing DP mechanisms for streaming data publication are not suitable for truth discovery as they fail to consider the different reliabilities of individuals, while the DP-based approaches for truth discovery are not suitable for streaming data because they ignore the correlations between truths over time. Directly applying these existing methods to streaming crowdsourced data would lead to low accuracy of the discovered truth. To solve this problem, in this paper, we propose an edge computing based privacy-preserving truth discovery mechanism, named PrivSTD, for streaming crowdsourced data to realize high accuracy of discovered truth while protecting the privacy of workers. Specifically, edge servers are introduced between the untrusted cloud server and workers to securely calculate the local truths and workers’ reliabilities. A truth-dependent budget recycle mechanism is proposed for each edge server to adaptively determine the perturbed timestamp and allocate the privacy budget according to the changing pattern of local truths. Besides, a reliability-based perturbation mechanism is proposed to reduce the perturbation magnitude on the basis of worker's reliability. We theoretical analyze the data utility and computation cost of PrivSTD, and prove that PrivSTD can satisfy$w$-event ($\epsilon,\delta$)-differential privacy. Extensive experimental results on synthetic and real-world datasets demonstrate that PrivSTD achieves better utility than the state-of-the-art approaches.