INCIBE and atlanTTic work together on the Truffles privacy and security project

Two groups from the University of Vigo’s Research Centre for Telecommunication Technologies (atlanTTic), a member of the CIGUS Network, an initiative launched by the regional government (Xunta de Galicia) that groups together centres of accredited scientific excellence, are taking part in the TRUFFLES project  (Trusted Framework for Federated Learning Systems), together with the Spanish National Institute of Cybersecurity (INCIBE by its Spanish acronym), through the Secretary of State for Digitalisation and Artificial Intelligence.  

The atlanTTic groups involved in the project are the Signal Processing in Communications Group (GPSC), led by Professor Fernando Pérez González, and the Information & Computing Lab (I&CLAB), led by Professor Rebeca Díaz Redondo. Both groups have extensive experience in the fields of security, privacy, and artificial intelligence. The researchers involved in the project will develop complementary tools to measure and mitigate existing risks in federated learning.

Artificial intelligence (AI)-based algorithms need vast amounts of data for training, and in many practical scenarios, data owners have insufficient data to ensure effective algorithm learning. A potential solution is to share data with other owners, which would allow all parties to benefit from collaboration. However, this often risks breaching increasingly strict data protection regulations designed to safeguard individual rights, as noted by the TRUFFLES project leaders.

In this context, TRUFFLES aims to design and integrate new mechanisms and technologies that will strengthen and improve security and privacy in federated learning (FL) environments. Federated learning was conceived as a solution to this issue, as data owners can train their algorithms locally and then share the results with others in order to create a collaborative algorithm that benefits from the respective data.

TRUFFLES has several action lines, including the identification of realistic threats in federated learning environments and the creation of methods to measure privacy by quantifying the private information that threat actors may obtain, “as a tool for understanding the limitations of existing solutions.” Additionally, the project seeks to provide solutions that will mitigate or eliminate privacy leaks. The project also aims to implement a prototype to demonstrate how the techniques developed can be applied to a real-world scenario. Special attention will be given to a use case in the banking sector, where privacy is a critical requirement, specifically in the detection of fraudulent transactions.